hitoshura25/cvefixes huggingface dataset:
CVE-2020-11012 (Go, published 2020-04-23T22:15Z)
Description: value: MinIO versions before RELEASE.2020-04-23T00-58-49Z have an authentication bypass issue in the MinIO admin API. Given an admin access key, it is possible to perform admin API operations i.e. creating new service accounts for existing access keys - without knowing the admin secret key. This has been fixed and released in version RELEASE.2020-04-23T00-58-49Z.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/minio/minio
Files changed:
cmd/auth-handler.go
cmd/auth-handler_test.go
Commit message: fix: Add missing return in admin requests auth (#9422)



Vulnerable code:

Fixed code:
		return cred, nil, owner, s3Err


func TestValidateAdminSignature(t *testing.T) {

	ctx := context.Background()

	objLayer, fsDir, err := prepareFS()
	if err != nil {
		t.Fatal(err)
	}
	defer os.RemoveAll(fsDir)

	if err = newTestConfig(globalMinioDefaultRegion, objLayer); err != nil {
		t.Fatalf("unable initialize config file, %s", err)
	}

	creds, err := auth.CreateCredentials("admin", "mypassword")
	if err != nil {
		t.Fatalf("unable create credential, %s", err)
	}
	globalActiveCred = creds

	testCases := []struct {
		AccessKey string
		SecretKey string
		ErrCode   APIErrorCode
	}{
		{"", "", ErrInvalidAccessKeyID},
		{"admin", "", ErrSignatureDoesNotMatch},
		{"admin", "wrongpassword", ErrSignatureDoesNotMatch},
		{"wronguser", "mypassword", ErrInvalidAccessKeyID},
		{"", "mypassword", ErrInvalidAccessKeyID},
		{"admin", "mypassword", ErrNone},
	}

	for i, testCase := range testCases {
		req := mustNewRequest("GET", "http://localhost:9000/", 0, nil, t)
		if err := signRequestV4(req, testCase.AccessKey, testCase.SecretKey); err != nil {
			t.Fatalf("Unable to inititalized new signed http request %s", err)
		}
		_, _, _, s3Error := validateAdminSignature(ctx, req, globalMinioDefaultRegion)
		if s3Error != testCase.ErrCode {
			t.Errorf("Test %d: Unexpected s3error returned wanted %d, got %d", i+1, testCase.ErrCode, s3Error)
		}
	}
}
CVE-2022-24842 (Go, published 2022-04-12T18:15Z)
Description: value: MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RELEASE.2022-04-12T06-55-35Z`. Users unable to upgrade may workaround this issue by explicitly adding a `admin:CreateServiceAccount` deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/minio/minio
Files changed:
cmd/admin-handlers-users.go
cmd/admin-handlers-users_test.go
cmd/sts-handlers_test.go
Commit message: Fix service account privilege escalation (#14729)

Ensure that a regular unprivileged user is unable to create service accounts for other users/root.

Vulnerable code:
			DenyOnly:        true,

Fixed code:

	// 6. Check that service account cannot be created for some other user.
	c.mustNotCreateSvcAccount(ctx, globalActiveCred.AccessKey, userAdmClient)

	// 6. Check that service account cannot be created for some other user.
	c.mustNotCreateSvcAccount(ctx, globalActiveCred.AccessKey, userAdmClient)

	// 6. Check that service account cannot be created for some other user.
	c.mustNotCreateSvcAccount(ctx, globalActiveCred.AccessKey, userAdmClient)

	// 6. Check that service account cannot be created for some other user.
	c.mustNotCreateSvcAccount(ctx, globalActiveCred.AccessKey, userAdmClient)
CVE-2023-25812 (Go, published 2023-02-21T21:15Z)
Description: value: Minio is a Multi-Cloud Object Storage framework. Affected versions do not correctly honor a `Deny` policy on ByPassGoverance. Ideally, minio should return "Access Denied" to all users attempting to DELETE a versionId  with the special header `X-Amz-Bypass-Governance-Retention: true`.  However, this was not honored instead the request will be honored and an object under governance would be incorrectly deleted.  All users are advised to upgrade. There are no known workarounds for this issue.

Severity: nan (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/minio/minio
Files changed:
cmd/bucket-object-lock.go
Commit message: fix: evaluate BypassGov policy action in deletion correctly (#16635)



Vulnerable code:
			// If you try to delete objects protected by governance mode and have s3:BypassGovernanceRetention
			// or s3:GetBucketObjectLockConfiguration permissions, the operation will succeed.
			govBypassPerms1 := checkRequestAuthType(ctx, r, policy.BypassGovernanceRetentionAction, bucket, object.ObjectName)
			govBypassPerms2 := checkRequestAuthType(ctx, r, policy.GetBucketObjectLockConfigurationAction, bucket, object.ObjectName)
			if govBypassPerms1 != ErrNone && govBypassPerms2 != ErrNone {

Fixed code:
			// If you try to delete objects protected by governance mode and have s3:BypassGovernanceRetention, the operation will succeed.
			if checkRequestAuthType(ctx, r, policy.BypassGovernanceRetentionAction, bucket, object.ObjectName) != ErrNone {
CVE-2023-28433 (Go, published 2023-03-22T21:15Z)
Description: value: Minio is a Multi-Cloud Object Storage framework. All users on Windows prior to version RELEASE.2023-03-20T20-16-18Z are impacted. MinIO fails to filter the `\` character, which allows for arbitrary object placement across buckets. As a result, a user with low privileges, such as an access key, service account, or STS credential, which only has permission to `PutObject` in a specific bucket, can create an admin user. This issue is patched in RELEASE.2023-03-20T20-16-18Z. There are no known workarounds.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/minio/minio
Files changed:
cmd/generic-handlers.go
Commit message: fix: convert '\' to '/' on windows (#16852)



Vulnerable code:
	path = strings.TrimSpace(path)

Fixed code:
	"path/filepath"
	path = filepath.ToSlash(strings.TrimSpace(path)) // For windows '\' must be converted to '/'
CVE-2023-28434 (Go, published 2023-03-22T21:15Z)
Description: value: Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access. This issue has been patched in RELEASE.2023-03-20T20-16-18Z. As a workaround, enable browser API access and turn off `MINIO_BROWSER=off`. 

Severity: nan (CVSS v3 base score: 8.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/minio/minio
Files changed:
cmd/api-router.go
cmd/auth-handler.go
Commit message: fix: post policy request security bypass (#16849)



Vulnerable code:
		router.Methods(http.MethodPost).HeadersRegexp(xhttp.ContentType, "multipart/form-data*").HandlerFunc(
			collectAPIStats("postpolicybucket", maxClients(gz(httpTraceHdrs(api.PostPolicyBucketHandler)))))
	return strings.Contains(r.Header.Get(xhttp.ContentType), "multipart/form-data") &&
		r.Method == http.MethodPost

Fixed code:
		router.Methods(http.MethodPost).MatcherFunc(func(r *http.Request, _ *mux.RouteMatch) bool {
			return isRequestPostPolicySignatureV4(r)
		}).HandlerFunc(collectAPIStats("postpolicybucket", maxClients(gz(httpTraceHdrs(api.PostPolicyBucketHandler)))))
	"mime"
	mediaType, _, err := mime.ParseMediaType(r.Header.Get(xhttp.ContentType))
	if err != nil {
		return false
	}
	return mediaType == "multipart/form-data" && r.Method == http.MethodPost
CVE-2012-3501 (C, published 2012-08-25T10:29Z)
Description: value: The squidclamav_check_preview_handler function in squidclamav.c in SquidClamav 5.x before 5.8 and 6.x before 6.7 passes an unescaped URL to a system command call, which allows remote attackers to cause a denial of service (daemon crash) via a URL with certain characters, as demonstrated using %0D or %0A.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/darold/squidclamav
Files changed:
src/squidclamav.c
Commit message: Add a workaround for a squidGuard bug that unescape the URL and send it back unescaped. This could conduct in wrong result and ssquidclamav crash especially with URL containing the %0D or %0A character. John Xue


Vulnerable code:

	fprintf(sgfpw,"%s %s %s %s\n",httpinf.url,clientip,username,httpinf.method);

Fixed code:
char * replace(const char *s, const char *old, const char *new);
	char *rbuff = NULL;
	/* escaping escaped character to prevent unescaping by squidguard */
	rbuff = replace(httpinf.url, "%", "%25");
	fprintf(sgfpw,"%s %s %s %s\n",rbuff,clientip,username,httpinf.method);
	xfree(rbuff);

/**
 * Searches all occurrences of old into s
 * and replaces with new
 */
char *
replace(const char *s, const char *old, const char *new)
{
	char *ret;
	int i, count = 0;
	size_t newlen = strlen(new);
	size_t oldlen = strlen(old);

	for (i = 0; s[i] != '\0'; i++) {
		if (strstr(&s[i], old) == &s[i]) {
			count++;
			i += oldlen - 1;
		}
	}
	ret = malloc(i + 1 + count * (newlen - oldlen));
	if (ret != NULL) {
		i = 0;
		while (*s) {
			if (strstr(s, old) == s) {
				strcpy(&ret[i], new);
				i += newlen;
				s += oldlen;
			} else {
				ret[i++] = *s++;
			}
		}
		ret[i] = '\0';
	}

	return ret;
}
CVE-2019-14837 (JSON, published 2020-01-07T17:15Z)
Description: value: A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/keycloak/keycloak
Files changed:
examples/demo-template/testrealm.json
services/src/main/java/org/keycloak/services/managers/ClientManager.java
testsuite/integration-arquillian/test-apps/photoz/photoz-realm.json
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/admin/ClientTest.java
Commit message: KEYCLOAK-10780 Stop creating placeholder e-mails for service accounts (#228)


Vulnerable code:
            "email" : "service-account-product-sa-client@placeholder.org",
            user.setEmail(username + "@placeholder.org");
            serviceAccountUser.setEmail(username + "@placeholder.org");
      "email": "service-account-photoz-restful-api@placeholder.org",

Fixed code:
        // KEYCLOAK-11197 service accounts are no longer created with a placeholder e-mail.
        assertNull(userRep.getEmail());
CVE-2021-3632 (Java, published 2022-08-26T16:15Z)
Description: value: A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/keycloak/keycloak
Files changed:
services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnPasswordlessAuthenticatorFactory.java
Commit message: Prevent security flaw using passwordless authentication

If you register without an password or delete your last token your account can be hijacked. This is can be done by simply trying to login in that moment where the account is without a token. You get the "normal" registration dialog and can capture the complete account.


Vulnerable code:

Fixed code:

    @Override
    public boolean isUserSetupAllowed() {
        return false;
    }
CVE-2021-3856 (Java, published 2022-08-26T16:15Z)
Description: value: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.
Severity: nan (CVSS v3 base score: 4.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/keycloak/keycloak
Files changed:
services/src/main/java/org/keycloak/theme/ClassLoaderTheme.java
services/src/main/java/org/keycloak/theme/ClasspathThemeResourceProviderFactory.java
testsuite/integration-arquillian/tests/base/src/test/java/org/keycloak/testsuite/theme/ThemeResourceProviderTest.java
Commit message: [KEYCLOAK-19422] ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader


Vulnerable code:
    public InputStream getResourceAsStream(String path) {
        return classLoader.getResourceAsStream(resourceRoot + path);
        return classLoader.getResourceAsStream(THEME_RESOURCES_RESOURCES + path);

Fixed code:
    public InputStream getResourceAsStream(String path) throws IOException {
        final URL rootResourceURL = classLoader.getResource(resourceRoot);
        if (rootResourceURL == null) {
            return null;
        }
        final String rootPath = rootResourceURL.getPath();
        final URL resourceURL = classLoader.getResource(resourceRoot + path);
        if(resourceURL == null || !resourceURL.getPath().startsWith(rootPath)) {
            return null;
        }
        else {
            return resourceURL.openConnection().getInputStream();
        }
        final URL rootResourceURL = classLoader.getResource(THEME_RESOURCES_RESOURCES);
        if (rootResourceURL == null) {
            return null;
        }
        final String rootPath = rootResourceURL.getPath();
        final URL resourceURL = classLoader.getResource(THEME_RESOURCES_RESOURCES + path);
        if(resourceURL == null || !resourceURL.getPath().startsWith(rootPath)) {
            return null;
        }
        else {
            return resourceURL.openConnection().getInputStream();
        }
    @Test
    public void getResourceIllegalTraversal() {
        testingClient.server().run(session -> {
            try {
                Theme theme = session.theme().getTheme("base", Theme.Type.LOGIN);
                Assert.assertNull(theme.getResourceAsStream("../templates/test.ftl"));
            } catch (IOException e) {
                Assert.fail(e.getMessage());
            }
        });
    }
CVE-2014-125068 (JavaScript, published 2023-01-08T11:15Z)
Description: value: A vulnerability was found in saxman maps-js-icoads and classified as critical. This issue affects some unknown processing of the file http-server.js. The manipulation leads to path traversal. The patch is named 34b8b0cce2807b119f4cffda2ac48fc8f427d69a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217643.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/saxman/maps-js-icoads
Files changed:
http-server.js
Commit message: Return index.html for directory req's and prevent directory traversal req's


Vulnerable code:
  //console.log('[' + code + '] ' + string);
  filePath = '.' + filePath;
      log(404, filePath)

Fixed code:
var path = require('path');
//  console.log('[' + code + '] ' + string);
  // Get the absolute path for the request
  filePath = path.resolve('.' + filePath);

  // Rejesct queries ouside of the server root
  var serverPath = path.resolve('.');
  if (filePath.indexOf(serverPath) != 0 ) {
    log(403, filePath);
    response.writeHeader(403);
    response.end();

    return;
  }
      log(404, filePath);
    // Return index.html if directroy requested.
    if (fs.statSync(filePath).isDirectory()) {
      filePath += '/index.html';
    }
CVE-2014-125069 (JavaScript, published 2023-01-08T11:15Z)
Description: value: A vulnerability was found in saxman maps-js-icoads. It has been classified as problematic. Affected is an unknown function. The manipulation leads to exposure of information through directory listing. It is possible to launch the attack remotely. The name of the patch is 34b8b0cce2807b119f4cffda2ac48fc8f427d69a. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217644.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/saxman/maps-js-icoads
Files changed:
http-server.js
Commit message: Return index.html for directory req's and prevent directory traversal req's


Vulnerable code:
  //console.log('[' + code + '] ' + string);
  filePath = '.' + filePath;
      log(404, filePath)

Fixed code:
var path = require('path');
//  console.log('[' + code + '] ' + string);
  // Get the absolute path for the request
  filePath = path.resolve('.' + filePath);

  // Rejesct queries ouside of the server root
  var serverPath = path.resolve('.');
  if (filePath.indexOf(serverPath) != 0 ) {
    log(403, filePath);
    response.writeHeader(403);
    response.end();

    return;
  }
      log(404, filePath);
    // Return index.html if directroy requested.
    if (fs.statSync(filePath).isDirectory()) {
      filePath += '/index.html';
    }
CVE-2023-40235 (Java, published 2023-08-10T23:15Z)
Description: value: An NTLM Hash Disclosure was discovered in ArchiMate Archi before 5.1.0. When parsing the XMLNS value of an ArchiMate project file, if the namespace does not match the expected ArchiMate URL, the parser will access the provided resource. If the provided resource is a UNC path pointing to a share server that does not accept a guest account, the host will try to authenticate on the share by using the current user's session. NOTE: this issue occurs because Archi uses an unsafe configuration of the Eclipse Modeling Framework.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/archimatetool/archi
Files changed:
com.archimatetool.model/src/com/archimatetool/model/util/ArchimateResourceFactory.java
Commit message: Set OPTION_USE_PACKAGE_NS_URI_AS_LOCATION to false

- See https://github.com/archimatetool/archi/issues/946


Vulnerable code:

Fixed code:
        // Don't allow loading an unregistered URI in case of exploits
        resource.getDefaultLoadOptions().put(XMLResource.OPTION_USE_PACKAGE_NS_URI_AS_LOCATION, false);
CVE-2016-10703 (JavaScript, published 2017-12-14T19:29Z)
Description: value: A regular expression Denial of Service (DoS) vulnerability in the file lib/ecstatic.js of the ecstatic npm package, before version 2.0.0, allows a remote attacker to overload and crash a server by passing a maliciously crafted string.
Severity: HIGH (CVSS v3 base score: 7.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/jfhbrook/node-ecstatic
Files changed:
lib/ecstatic.js
Commit message: Remove stripping of null bytes

This was at one point necessary because of an old bug in url.parse

See: https://github.com/jfhbrook/node-ecstatic/issues/16#issuecomment-3039914
See: https://github.com/jfhbrook/node-ecstatic/commit/43f7e72a31524f88f47e367c3cc3af710e67c9f4

But this opens up a regex dos attack vector! D:

Based on some research (ie asking #node-dev if this is still an issue),
it's *probably* not an issue. :)


Vulnerable code:

Fixed code:
    // This was at one point necessary because of an old bug in url.parse
    //
    // See: https://github.com/jfhbrook/node-ecstatic/issues/16#issuecomment-3039914
    // See: https://github.com/jfhbrook/node-ecstatic/commit/43f7e72a31524f88f47e367c3cc3af710e67c9f4
    //
    // But this opens up a regex dos attack vector! D:
    //
    // Based on some research (ie asking #node-dev if this is still an issue),
    // it's *probably* not an issue. :)
    /*
    */
CVE-2015-8947 (C++, published 2016-07-19T10:59Z)
Description: value: hb-ot-layout-gpos-table.hh in HarfBuzz before 1.0.5 allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data, a different vulnerability than CVE-2016-2052.
Severity: HIGH (CVSS v3 base score: 7.6)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/behdad/harfbuzz
Files changed:
src/hb-ot-layout-gpos-table.hh
Commit message: Fix another memory access issue discovered by libFuzzer

Fixes https://github.com/behdad/harfbuzz/issues/139#issuecomment-146984679


Vulnerable code:
    return_trace (c->check_struct (this) && coverage.sanitize (c, this) && pairSet.sanitize (c, this, &closure));

Fixed code:
    if (!c->check_struct (this)) return_trace (false);

    return_trace (coverage.sanitize (c, this) && pairSet.sanitize (c, this, &closure));