hitoshura25/cvefixes huggingface dataset:
CVE-2017-5336 (C, published 2017-03-24T15:59Z)
Description: value: Stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://gitlab.com/gnutls/gnutls
Files changed:
lib/opencdk/pubkey.c
Commit message: opencdk: cdk_pk_get_keyid: fix stack overflow

Issue found using oss-fuzz:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=340

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>


Vulnerable code:
			_gnutls_mpi_print(pk->mpi[0], p, &n);

Fixed code:
	int rc;
			rc = _gnutls_mpi_print(pk->mpi[0], p, &n);
			if (rc < 0 || n < 8) {
				keyid[0] = keyid[1] = (u32)-1;
				return (u32)-1;
			}
CVE-2017-5337 (C, published 2017-03-24T15:59Z)
Description: value: Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://gitlab.com/gnutls/gnutls
Files changed:
lib/opencdk/read-packet.c
Commit message: opencdk: read_attribute: added more precise checks when reading stream

That addresses heap read overflows found using oss-fuzz:
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=338
  https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=346

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>


Vulnerable code:
		cdk_free(buf);
		return CDK_Inv_Packet;
			cdk_free(buf);
			return CDK_Inv_Packet;
	if (*p != 1) {		/* Currently only 1, meaning an image, is defined. */
		cdk_free(buf);
		return CDK_Inv_Packet;
		cdk_free(buf);
		return CDK_Inv_Packet;
		cdk_free(buf);
		return CDK_Out_Of_Core;

Fixed code:
		gnutls_assert();
		rc = CDK_Inv_Packet;
		goto error;


		if (pktlen < 4) {
			gnutls_assert();
			rc = CDK_Inv_Packet;
			goto error;
		}

			gnutls_assert();
			rc = CDK_Inv_Packet;
			goto error;

	if (!len || *p != 1) {		/* Currently only 1, meaning an image, is defined. */
		rc = CDK_Inv_Packet;
		goto error;

		rc = CDK_Inv_Packet;
		goto error;

		rc = CDK_Out_Of_Core;
		goto error;


 error:
	cdk_free(buf);
	return rc;
CVE-2017-7869 (C, published 2017-04-14T04:59Z)
Description: value: GnuTLS before 2017-02-20 has an out-of-bounds write caused by an integer overflow and heap-based buffer overflow related to the cdk_pkt_read function in opencdk/read-packet.c. This issue (which is a subset of the vendor's GNUTLS-SA-2017-3 report) is fixed in 3.5.10.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://gitlab.com/gnutls/gnutls
Files changed:
lib/opencdk/read-packet.c
Commit message: cdk_pkt_read: enforce packet limits

That ensures that there are no overflows in the subsequent
calculations.

Resolves the oss-fuzz found bug:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=420

Relates: #159

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>


Vulnerable code:

Fixed code:
#define MAX_PACKET_LEN (1<<24)
	/* enforce limits to ensure that the following calculations
	 * do not overflow */
	if (pktlen >= MAX_PACKET_LEN || pktsize >= MAX_PACKET_LEN) {
		_cdk_log_info("cdk_pkt_read: too long packet\n");
		return gnutls_assert_val(CDK_Inv_Packet);
	}
CVE-2021-23362 (JavaScript, published 2021-03-23T17:15Z)
Description: value: The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/npm/hosted-git-info
Files changed:
index.js
Commit message: fix: simplify the regular expression for shortcut matching

PR-URL: https://github.com/npm/hosted-git-info/pull/76
Credit: @nlf
Close: #76
Reviewed-by: @isaacs


Vulnerable code:
  var shortcutMatch = url.match(new RegExp('^([^:]+):(?:(?:[^@:]+(?:[^@]+)?@)?([^/]*))[/](.+?)(?:[.]git)?($|#)'))
        project = decodeURIComponent(shortcutMatch[3])

Fixed code:
  var shortcutMatch = url.match(/^([^:]+):(?:[^@]+@)?(?:([^/]*)\/)?([^#]+)/)
        project = decodeURIComponent(shortcutMatch[3].replace(/\.git$/, ''))
CVE-2020-7733 (JavaScript, published 2020-09-16T14:15Z)
Description: value: The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/faisalman/ua-parser-js
Files changed:
src/ua-parser.js
Commit message: Fix potential ReDoS vulnerability


Vulnerable code:
            /android.+(redmi[\s\-_]*(?:note)?(?:[\s_]*[\w\s]+))\s+build/i       // Redmi Phones
            /android.+(mi[\s\-_]*(?:pad)(?:[\s_]*[\w\s]+))\s+build/i            // Mi Pad tablets

Fixed code:
            /android.+(redmi[\s\-_]*(?:note)?(?:[\s_]?[\w\s]+))\s+build/i       // Redmi Phones
            /android.+(mi[\s\-_]*(?:pad)(?:[\s_]?[\w\s]+))\s+build/i            // Mi Pad tablets
CVE-2021-27292 (JavaScript, published 2021-03-17T13:15Z)
Description: value: ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/faisalman/ua-parser-js
Files changed:
src/ua-parser.js
Commit message: Fix potential ReDoS vulnerability as reported by Doyensec


Vulnerable code:
            /android.+[;\/]\s+(Barnes[&\s]+Noble\s+|BN[RT])(V?.*)\s+build/i     // Barnes & Noble Tablet
            /(phone)/i,

Fixed code:
            /android.+[;\/]\s+(Barnes[&\s]+Noble\s+|BN[RT])(\S(?:.*\S)?)\s+build/i     // Barnes & Noble Tablet
            /(phone)/i
CVE-2022-25927 (JavaScript, published 2023-01-26T21:15Z)
Description: value: Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS) via the trim() function.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/faisalman/ua-parser-js
Files changed:
src/ua-parser.js
Commit message: Remove unsafe regex in trim() function

`trim()` function contains a regular expression that is vulnerable to ReDoS but was uncaught by `safe-regex` module.


Vulnerable code:
                str = str.replace(/^\s\s*/, EMPTY).replace(/\s\s*$/, EMPTY);

Fixed code:
                str = str.replace(/^\s\s*/, EMPTY);
CVE-2015-10091 (Perl, published 2023-03-06T04:15Z)
Description: value: A vulnerability has been found in ByWater Solutions bywater-koha-xslt and classified as critical. This vulnerability affects the function StringSearch of the file admin/systempreferences.pl. The manipulation of the argument name leads to sql injection. The attack can be initiated remotely. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as 9513b93c828dfbc4413f9e0df63647401aaf4e58. It is recommended to apply a patch to fix this issue. VDB-222322 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/bywatersolutions/bywater-koha-xslt
Files changed:
admin/systempreferences.pl
Commit message: Bug 14521: SQL injection in local use system preferences

This patch fixes a SQL injection vulnerability in the local use
system preferences.

_TEST PLAN_

Before applying:

1) Go to Global System Preferences
2) Click on the "Local use" tab
3) Add a new preference with the value "') or '1' = '1' -- "
(be sure to include the space at the end after the comment --).
4) When the page refreshes, you should now see about 99 other system
preferences which shouldn't be showing up.

5) Apply the patch

6) Refresh the page
7) Note that you now only see a system preference for "') or '1' = '1' -- "
and the other actual local use system preferences.

Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Signed-off-by: Tomas Cohen Arazi <tomascohen@unc.edu.ar>
(cherry picked from commit a72262a950aa701cebe460e2a3a7586edecd86be)
Signed-off-by: Chris Cormack <chrisc@catalyst.net.nz>
Signed-off-by: Liz Rea <wizzyrea@gmail.com>


Vulnerable code:
                $strsth .= "'$name'";
    $sth->execute();

Fixed code:
    my @sql_bind;
                $strsth .= "?";
                push(@sql_bind,$name);
    $sth->execute(@sql_bind);
CVE-2020-7649 (JavaScript, published 2022-07-25T14:15Z)
Description: value: This affects the package snyk-broker before 4.73.0. It allows arbitrary file reads for users with access to Snyk's internal network via directory traversal.
Severity: nan (CVSS v3 base score: 4.9)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/snyk/broker
Files changed:
lib/filters/index.js
test/fixtures/accept/github.json
test/unit/filters.test.js
Commit message: feat: reject paths with directory traversal


Vulnerable code:
    let { method, origin, path, valid, stream } = entry;
    path = (path || '').replace(/(\${.*?})/g, (_, match) => {
    if (path[0] !== '/') {
      path = '/' + path;
    logger.info({ method, path }, 'adding new filter rule');
    const regexp = pathRegexp(path, keys);
      logger.debug({ path, origin, url, querystring }, 'rule matched');
    t.plan(3);

Fixed code:
const path = require('path');
    let { method, origin, path: entryPath, valid, stream } = entry;
    entryPath = (entryPath || '').replace(/(\${.*?})/g, (_, match) => {
    if (entryPath[0] !== '/') {
      entryPath = '/' + entryPath;
    logger.info({ method, path: entryPath }, 'adding new filter rule');
    const regexp = pathRegexp(entryPath, keys);
      // Do not allow directory traversal
      if (path.normalize(req.url) !== req.url) {
        return false;
      }

      logger.debug({ path: entryPath, origin, url, querystring }, 'rule matched');
    },
    {
      "//": "used to whitelist a folder",
      "method": "GET",
      "path": "/repos/:name/:repo/contents/:path*/docs/*",
      "origin": "https://${GITHUB_TOKEN}@${GITHUB_API}"
    t.plan(4);
    t.test('should block when path includes directory traversal', (t) => {
      filter({
        url: '/repos/angular/angular/contents/path/to/docs/../../sensitive/file.js',
        method: 'GET',
      }, (error, res) => {
        t.equal(error.message, 'blocked', 'has been blocked');
        t.equal(res, undefined, 'no follow allowed');
      });

      t.end();
    });
CVE-2020-15129 (Go, published 2020-07-30T16:15Z)
Description: value: In Traefik before versions 1.7.26, 2.2.8, and 2.3.0-rc3, there exists a potential open redirect vulnerability in Traefik's handling of the "X-Forwarded-Prefix" header. The Traefik API dashboard component doesn't validate that the value of the header "X-Forwarded-Prefix" is a site relative path and will redirect to any header provided URI. Successful exploitation of an open redirect can be used to entice victims to disclose sensitive information. Active Exploitation of this issue is unlikely as it would require active header injection, however the Traefik team addressed this issue nonetheless to prevent abuse in e.g. cache poisoning scenarios.
Severity: MEDIUM (CVSS v3 base score: 4.7)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/containous/traefik
Files changed:
pkg/api/dashboard.go
pkg/api/dashboard_test.go
Commit message: fix: clean X-Forwarded-Prefix header for the dashboard.




Vulnerable code:
		HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
			http.Redirect(response, request, request.Header.Get("X-Forwarded-Prefix")+"/dashboard/", http.StatusFound)

Fixed code:
	"net/url"
		HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
			http.Redirect(resp, req, safePrefix(req)+"/dashboard/", http.StatusFound)

func safePrefix(req *http.Request) string {
	prefix := req.Header.Get("X-Forwarded-Prefix")
	if prefix == "" {
		return ""
	}

	parse, err := url.Parse(prefix)
	if err != nil {
		return ""
	}

	if parse.Host != "" {
		return ""
	}

	return parse.Path
}
package api

import (
	"net/http"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func Test_safePrefix(t *testing.T) {
	testCases := []struct {
		desc     string
		value    string
		expected string
	}{
		{
			desc:     "host",
			value:    "https://example.com",
			expected: "",
		},
		{
			desc:     "host with path",
			value:    "https://example.com/foo/bar?test",
			expected: "",
		},
		{
			desc:     "path",
			value:    "/foo/bar",
			expected: "/foo/bar",
		},
		{
			desc:     "path without leading slash",
			value:    "foo/bar",
			expected: "foo/bar",
		},
	}

	for _, test := range testCases {
		test := test
		t.Run(test.desc, func(t *testing.T) {
			t.Parallel()

			req, err := http.NewRequest(http.MethodGet, "http://localhost", nil)
			require.NoError(t, err)

			req.Header.Set("X-Forwarded-Prefix", test.value)

			prefix := safePrefix(req)

			assert.Equal(t, test.expected, prefix)
		})
	}
}
CVE-2020-25739 (Ruby, published 2020-09-23T14:15Z)
Description: value: An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gazay/gon
Files changed:
.travis.yml
CHANGELOG.md
gon.gemspec
lib/gon/json_dumper.rb
lib/gon/version.rb
Commit message: CVE-2020-25739: Enforce HTML entities escaping in gon output

Version 6.4.0


Vulnerable code:
  - 2.3.7
  - 2.4.4
  - 2.5.1
      MultiJson.dump object,
  VERSION = '6.3.2'

Fixed code:
  - 2.3.8
  - 2.4.10
  - 2.5.8
  - 2.6.6
  - 2.7.1
## [6.4.0] - 2020-09-18
### Security
- CVE-2020-25739: Enforce HTML entities escaping in gon output

  s.add_development_dependency 'pry-byebug'
    # Taken from ERB::Util
    JSON_ESCAPE_REGEXP	=	/[\u2028\u2029&><]/u
    JSON_ESCAPE	=	{
      "&" => '\u0026',
      ">" => '\u003e',
      "<" => '\u003c',
      "\u2028" => '\u2028',
      "\u2029" => '\u2029'
    }

      dumped_json = MultiJson.dump object,
      escape(dumped_json)
    end

    def self.escape(json)
      json.gsub(JSON_ESCAPE_REGEXP, JSON_ESCAPE)
  VERSION = '6.4.0'
CVE-2020-5390 (Other, published 2020-01-13T19:15Z)
Description: value: PySAML2 before 5.0.0 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i.e., it is affected by XML Signature Wrapping (XSW). The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/IdentityPython/pysaml2
Files changed:
CHANGELOG.md
VERSION
Commit message: Release version 5.0.0

Signed-off-by: Ivan Kanakarakis <ivan.kanak@gmail.com>


Vulnerable code:
4.9.0

Fixed code:
## 5.0.0 (2020-01-13)

- Fix XML Signature Wrapping (XSW) vulnerabilities - CVE-2020-5390
- Add freshness period feature for MetaDataMDX
- Fix bug in duration calculation in time_util library
- Fix ipv6 validation to accommodate for addresses with brackets
- Fix xmlsec temporary files deletions
- Add method to get supported algorithms from metadata
- Add mdstore method to extract assurance certifications
- Add mdstore method to extract contact_person data
- Add attribute mappings from the Swiss eduPerson Schema
- Make AESCipher and Fernet interfaces compatible
- Remove deprecated saml2.aes module
- Remove deprecated saml2.extensions.ui module
- Replace deprecated mongodb operations
- Rename ToOld error to TooOld
- Fix pytest warnings
- Mock tests that need a network connection
- Start dropping python2 support


5.0.0
CVE-2021-21238 (Unknown, published 2021-01-21T15:15Z)
Description: value: PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. All users of pysaml2 that need to validate signed SAML documents are impacted. The vulnerability is a variant of XML Signature wrapping because it did not validate the SAML document against an XML schema. This allowed invalid XML documents to be processed and such a document can trick pysaml2 with a wrapped signature. This is fixed in PySAML2 6.5.0.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/IdentityPython/pysaml2
Files changed:
Commit message: Merge pull request from GHSA-f4g9-h89h-jgv9

Validate XML documents before verifying the signature

Vulnerable code:

Fixed code:
CVE-2021-21239 (Unknown, published 2021-01-21T15:15Z)
Description: value: PySAML2 is a pure python implementation of SAML Version 2 Standard. PySAML2 before 6.5.0 has an improper verification of cryptographic signature vulnerability. Users of pysaml2 that use the default CryptoBackendXmlSec1 backend and need to verify signed SAML documents are impacted. PySAML2 does not ensure that a signed SAML document is correctly signed. The default CryptoBackendXmlSec1 backend is using the xmlsec1 binary to verify the signature of signed SAML documents, but by default xmlsec1 accepts any type of key found within the given document. xmlsec1 needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature. This is fixed in PySAML2 6.5.0.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-347 \u2014 Improper Verification of Cryptographic Signature
The product does not verify, or incorrectly verifies, the cryptographic signature for data.
Repository: https://github.com/IdentityPython/pysaml2
Files changed:
Commit message: Merge pull request from GHSA-5p3x-r448-pc62

Restrict the key data that xmlsec1 accepts to only x509 certs

Vulnerable code:

Fixed code:
CVE-2021-41246 (Unknown, published 2021-12-09T16:15Z)
Description: value: Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including `2.5.1` do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions `2.5.2` contains a patch for this issue.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/auth0/express-openid-connect
Files changed:
Commit message: Merge pull request from GHSA-7rg2-qxmf-hhx9

Advisory fix 1

Vulnerable code:

Fixed code: