hitoshura25/cvefixes huggingface dataset:
CVE-2022-36021 (Other, published 2023-03-01T16:15Z)
Description: value: Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. The problem is fixed in Redis versions 6.0.18, 6.2.11, 7.0.9.

Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-407 \u2014 Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
Repository: https://github.com/redis/redis
Files changed:
src/util.c
tests/unit/keyspace.tcl
Commit message: String pattern matching had exponential time complexity on pathological patterns (CVE-2022-36021) (#11858)

Authenticated users can use string matching commands with a
specially crafted pattern to trigger a denial-of-service attack on Redis,
causing it to hang and consume 100% CPU time.

Co-authored-by: Tom Levy <tomlevy93@gmail.com>

Vulnerable code:
int stringmatchlen(const char *pattern, int patternLen,
        const char *string, int stringLen, int nocase)
                if (stringmatchlen(pattern+1, patternLen-1,
                            string, stringLen, nocase))

Fixed code:
static int stringmatchlen_impl(const char *pattern, int patternLen,
        const char *string, int stringLen, int nocase, int *skipLongerMatches)
                if (stringmatchlen_impl(pattern+1, patternLen-1,
                            string, stringLen, nocase, skipLongerMatches))
                if (*skipLongerMatches)
                    return 0; /* no match */
            /* There was no match for the rest of the pattern starting
             * from anywhere in the rest of the string. If there were
             * any '*' earlier in the pattern, we can terminate the
             * search early without trying to match them to longer
             * substrings. This is because a longer match for the
             * earlier part of the pattern would require the rest of the
             * pattern to match starting later in the string, and we
             * have just determined that there is no match for the rest
             * of the pattern starting from anywhere in the current
             * string. */
            *skipLongerMatches = 1;
int stringmatchlen(const char *pattern, int patternLen,
        const char *string, int stringLen, int nocase) {
    int skipLongerMatches = 0;
    return stringmatchlen_impl(pattern,patternLen,string,stringLen,nocase,&skipLongerMatches);
}


    test {Regression for pattern matching long nested loops} {
        r flushdb
        r SET aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 1
        r KEYS "a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*a*b"
    } {}
CVE-2023-22458 (Other, published 2023-01-20T19:15Z)
Description: value: Redis is an in-memory database that persists on disk. Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. This problem affects Redis versions 6.2 or newer up to but not including 6.2.9 as well as versions 7.0 up to but not including 7.0.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/redis/redis
Files changed:
src/t_hash.c
src/t_zset.c
tests/unit/type/hash.tcl
tests/unit/type/zset.tcl
Commit message: Fix range issues in ZRANDMEMBER and HRANDFIELD (CVE-2023-22458) (#11674)

missing range check in ZRANDMEMBER and HRANDIFLD leading to panic due
to protocol limitations

Vulnerable code:
        } else if (c->argc == 4)
        } else if (c->argc == 4)

Fixed code:
        } else if (c->argc == 4) {
            if (l < LONG_MIN/2 || l > LONG_MAX/2) {
                addReplyError(c,"value is out of range");
                return;
            }
        }
        } else if (c->argc == 4) {
            if (l < LONG_MIN/2 || l > LONG_MAX/2) {
                addReplyError(c,"value is out of range");
                return;
            }
        }
    test "HRANDFIELD count overflow" {
        r hmset myhash a 1
        assert_error {*value is out of range*} {r hrandfield myhash -9223372036854770000 withvalues}
    } {}

    test "ZRANDMEMBER count overflow" {
        r zadd myzset 0 a
        assert_error {*value is out of range*} {r zrandmember myzset -9223372036854770000 withscores}
    } {}
CVE-2023-28425 (Other, published 2023-03-20T20:15Z)
Description: value: Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/redis/redis
Files changed:
src/t_string.c
tests/unit/type/string.tcl
Commit message: Avoid assertion when MSETNX is used with the same key twice (CVE-2023-28425) (#11940)

Using the same key twice in MSETNX command would trigger an assertion.

This reverts #11594 (introduced in Redis 7.0.8)

Vulnerable code:
    int setkey_flags = 0;
        setkey_flags |= SETKEY_DOESNT_EXIST;
        setKey(c, c->db, c->argv[j], c->argv[j + 1], setkey_flags);

Fixed code:
        setKey(c, c->db, c->argv[j], c->argv[j + 1], 0);
    test {MSETNX with not existing keys - same key twice} {
        r del x1{t}
        list [r msetnx x1{t} xxx x1{t} yyy] [r get x1{t}]
    } {1 yyy}

    test {MSETNX with already existing keys - same key twice} {
        list [r msetnx x1{t} xxx x1{t} zzz] [r get x1{t}]
    } {0 yyy}
CVE-2023-28856 (Other, published 2023-04-18T21:15Z)
Description: value: Redis is an open source, in-memory database that persists on disk. Authenticated users can use the `HINCRBYFLOAT` command to create an invalid hash field that will crash Redis on access in affected versions. This issue has been addressed in in versions 7.0.11, 6.2.12, and 6.0.19. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-617 \u2014 Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
Repository: https://github.com/redis/redis
Files changed:
src/t_hash.c
tests/unit/type/hash.tcl
Commit message: fix hincrbyfloat not to create a key if the new value is invalid (#11149)

Check the validity of the value before performing the create operation,
prevents new data from being generated even if the request fails to execute.

Co-authored-by: Oran Agra <oran@redislabs.com>
Co-authored-by: chendianqiang <chendianqiang@meituan.com>
Co-authored-by: Binbin <binloveplay1314@qq.com>

Vulnerable code:

Fixed code:
    if (isnan(incr) || isinf(incr)) {
        addReplyError(c,"value is NaN or Infinity");
        return;
    }
    test {HINCRBYFLOAT does not allow NaN or Infinity} {
        assert_error "*value is NaN or Infinity*" {r hincrbyfloat hfoo field +inf}
        assert_equal 0 [r exists hfoo]
    }
CVE-2023-45145 (C, published 2023-10-18T21:15Z)
Description: value: Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.
Severity: nan (CVSS v3 base score: 3.6)
Weakness: CWE-668 \u2014 Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Repository: https://github.com/redis/redis
Files changed:
src/anet.c
Commit message: Fix issue of listen before chmod on Unix sockets (CVE-2023-45145) (#12671)

Before this commit, Unix socket setup performed chmod(2) on the socket
file after calling listen(2). Depending on what umask is used, this
could leave the file with the wrong permissions for a short period of
time. As a result, another process could exploit this race condition and
establish a connection that would otherwise not be possible.

We now make sure the socket permissions are set up prior to calling
listen(2).

(cherry picked from commit 1119ecae6fd8796fa337df2212f09173ab6c7b0a)

Co-authored-by: Yossi Gottlieb <yossigo@gmail.com>

Vulnerable code:
static int anetListen(char *err, int s, struct sockaddr *sa, socklen_t len, int backlog) {
        if (anetListen(err,s,p->ai_addr,p->ai_addrlen,backlog) == ANET_ERR) s = ANET_ERR;
    if (anetListen(err,s,(struct sockaddr*)&sa,sizeof(sa),backlog) == ANET_ERR)
    if (perm)
        chmod(sa.sun_path, perm);

Fixed code:
static int anetListen(char *err, int s, struct sockaddr *sa, socklen_t len, int backlog, mode_t perm) {
    if (sa->sa_family == AF_LOCAL && perm)
        chmod(((struct sockaddr_un *) sa)->sun_path, perm);

        if (anetListen(err,s,p->ai_addr,p->ai_addrlen,backlog,0) == ANET_ERR) s = ANET_ERR;
    if (anetListen(err,s,(struct sockaddr*)&sa,sizeof(sa),backlog,perm) == ANET_ERR)
CVE-2011-1575 (C, published 2011-05-23T22:55Z)
Description: value: The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/jedisct1/pure-ftpd
Files changed:
src/ftp_parser.c
Commit message: Flush the command buffer after switching to TLS.
Fixes a flaw similar to CVE-2011-0411.


Vulnerable code:
    static size_t scanned;
    static size_t readnbd;

Fixed code:
static size_t scanned;
static size_t readnbd;

static void flush_cmd(void)
{
    scanned = readnbd = (size_t) 0U;
}

                flush_cmd();
CVE-2019-20176 (C, published 2019-12-31T15:15Z)
Description: value: In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/jedisct1/pure-ftpd
Files changed:
src/ls.c
Commit message: listdir(): reuse a single buffer to store every file name to display

Allocating a new buffer for each entry is useless.

And as these buffers are allocated on the stack, on systems with a
small stack size, with many entries, the limit can easily be reached,
causing a stack exhaustion and aborting the user session.

Reported by Antonio Morales from the GitHub Security Lab team, thanks!


Vulnerable code:
            char *alloca_subdir;
            const size_t sizeof_subdir = PATH_MAX + 1U;

            if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) {
                goto toomany;
            }
            ALLOCA_FREE(alloca_subdir);

Fixed code:
    char *alloca_subdir;
    size_t sizeof_subdir;
    sizeof_subdir = PATH_MAX + 1U;
    if ((alloca_subdir = ALLOCA(sizeof_subdir)) == NULL) {
        goto toomany;
    }

    ALLOCA_FREE(alloca_subdir);
CVE-2020-9274 (C, published 2020-02-26T16:15Z)
Description: value: An issue was discovered in Pure-FTPd 1.0.49. An uninitialized pointer vulnerability has been detected in the diraliases linked list. When the *lookup_alias(const char alias) or print_aliases(void) function is called, they fail to correctly detect the end of the linked list and try to access a non-existent list member. This is related to init_aliases in diraliases.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-824 \u2014 Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.
Repository: https://github.com/jedisct1/pure-ftpd
Files changed:
src/diraliases.c
Commit message: diraliases: always set the tail of the list to NULL

Spotted and reported by Antonio Norales from GitHub Security Labs.
Thanks!


Vulnerable code:
            tail->next = NULL;

Fixed code:
        tail->next = NULL;
CVE-2020-9365 (C, published 2020-02-24T16:15Z)
Description: value: An issue was discovered in Pure-FTPd 1.0.49. An out-of-bounds (OOB) read has been detected in the pure_strcmp function in utils.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/jedisct1/pure-ftpd
Files changed:
src/utils.c
Commit message: pure_strcmp(): len(s2) can be > len(s1)

Reported by Antonio Morales from GitHub Security Labs, thanks!


Vulnerable code:
    return pure_memcmp(s1, s2, strlen(s1) + 1U);

Fixed code:
    const size_t s1_len = strlen(s1);
    const size_t s2_len = strlen(s2);
    const size_t len = (s1_len < s2_len) ? s1_len : s2_len;

    return pure_memcmp(s1, s2, len + 1);
CVE-2021-40524 (C, published 2021-09-05T19:15Z)
Description: value: In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/jedisct1/pure-ftpd
Files changed:
src/ftpd.c
Commit message: Initialize the max upload file size when quotas are enabled

Due to an unwanted check, files causing the quota to be exceeded
were deleted after the upload, but not during the upload.

The bug was introduced in 2009 in version 1.0.23

Spotted by @DroidTest, thanks!


Vulnerable code:
         (max_filesize >= (off_t) 0 &&
          (max_filesize = user_quota_size - quota.size) < (off_t) 0))) {

Fixed code:
         (max_filesize = user_quota_size - quota.size) < (off_t) 0)) {
CVE-2020-12790 (Unknown, published 2020-05-11T19:15Z)
Description: value: In the SEOmatic plugin before 3.2.49 for Craft CMS, helpers/DynamicMeta.php does not properly sanitize the URL. This leads to Server-Side Template Injection and credentials disclosure via a crafted Twig template after a semicolon.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/nystudio107/craft-seomatic
Files changed:
Commit message: Merge branch 'release/3.2.49' into v3


Vulnerable code:

Fixed code:
CVE-2020-9757 (Markdown, published 2020-03-04T17:15Z)
Description: value: The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/nystudio107/craft-seomatic
Files changed:
CHANGELOG.md
Commit message: Version 3.3.0


Vulnerable code:

Fixed code:
### Security
* Fixed a regression where malformed data passed to the metacontainers controller could result in SSTI which leads to information disclosure
CVE-2020-9757 (Markdown, published 2020-03-04T17:15Z)
Description: value: The SEOmatic component before 3.3.0 for Craft CMS allows Server-Side Template Injection that leads to RCE via malformed data to the metacontainers controller.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/nystudio107/craft-seomatic
Files changed:
CHANGELOG.md
Commit message: Version 3.2.46

Signed-off-by: Andrew Welch <andrew@nystudio107.com>


Vulnerable code:
* Fixed an issue where malformed data passed to the metacontainers controller could result in XSS

Fixed code:
* Fixed an issue where malformed data passed to the metacontainers controller could result in SSTI which leads to information disclosure
CVE-2021-41749 (PHP, published 2022-06-12T11:15Z)
Description: value: In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/nystudio107/craft-seomatic
Files changed:
src/services/Helper.php
Commit message: Sanitize the canonical URL after the absolute URL has been returned, to mitigate poisoned `X-Forwarded-Host` headers


Vulnerable code:
        $url = DynamicMetaHelper::sanitizeUrl($url);
        return UrlHelper::absoluteUrlWithProtocol($url);

Fixed code:
        return DynamicMetaHelper::sanitizeUrl(UrlHelper::absoluteUrlWithProtocol($url));
CVE-2021-41750 (PHP, published 2022-06-12T12:15Z)
Description: value: A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nystudio107/craft-seomatic
Files changed:
src/controllers/FileController.php
Commit message: Disallow SVGs


Vulnerable code:
            if ($ext === '' || !in_array($ext, $allowedExtensions, true)) {

Fixed code:
            if ($ext === '' || $ext === 'svg' || !in_array($ext, $allowedExtensions, true)) {
CVE-2021-41750 (PHP, published 2022-06-12T12:15Z)
Description: value: A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/nystudio107/craft-seomatic
Files changed:
src/controllers/FileController.php
Commit message: Ensure that only files with the extensions listed in `allowedFileExtensions` General Config setting can be used with the SEO File Link controller

Signed-off-by: Andrew Welch <andrew@nystudio107.com>


Vulnerable code:

Fixed code:
use craft\elements\Asset;
use craft\helpers\Assets as AssetsHelper;
use yii\web\ServerErrorHttpException;
            // Ensure the file type is allowed
            // ref: https://craftcms.com/docs/3.x/config/config-settings.html#allowedfileextensions
            $allowedExtensions = Craft::$app->getConfig()->getGeneral()->allowedFileExtensions;
            if (($ext = pathinfo($fileName, PATHINFO_EXTENSION)) !== '') {
                $ext = strtolower($ext);
            }
            if ($ext === '' || !in_array($ext, $allowedExtensions, true)) {
                throw new ServerErrorHttpException(Craft::t('seomatic', 'File format not allowed.'));
            }
CVE-2021-44618 (PHP, published 2022-03-11T16:15Z)
Description: value: A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12 in src/helpers/UrlHelper.php via the host header.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/nystudio107/craft-seomatic
Files changed:
src/helpers/UrlHelper.php
Commit message: Sanitize all URLs

Signed-off-by: Andrew Welch <andrew@nystudio107.com>


Vulnerable code:
        return parent::siteUrl($path, $params, $scheme, $siteId);
        return $url;

Fixed code:
        return DynamicMeta::sanitizeUrl(parent::siteUrl($path, $params, $scheme, $siteId));
        return DynamicMeta::sanitizeUrl($url);