hitoshura25/cvefixes huggingface dataset:
CVE-2021-23158 (Other, published 2022-03-16T15:15Z)
Description: value: A flaw was found in htmldoc in v1.9.12. Double-free in function pspdf_export(),in ps-pdf.cxx may result in a write-what-where condition, allowing an attacker to execute arbitrary code and denial of service.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/file.c
htmldoc/image.cxx
htmldoc/ps-pdf.cxx
Commit message: Fix JPEG error handling (Issue #415)


Vulnerable code:
      return (wc->url);
  struct jpeg_error_mgr		jerr;		/* Error handler info */
  JSAMPROW			row;		/* Sample row pointer */
  jpeg_std_error(&jerr);
  jerr.error_exit = jpeg_error_handler;
  cinfo.err = &jerr;
jpeg_error_handler(j_common_ptr)
  return;

Fixed code:
- Fixed JPEG error handling (Issue #415)
  {
    {
      if (!strncmp(wc->url, "data:", 5))
        return ("data URL");
      else
        return (wc->url);
    }
  }
typedef struct hd_jpeg_err_s	// JPEG error manager extension
{
  struct jpeg_error_mgr	jerr;	// JPEG error manager information
  jmp_buf	retbuf;		// setjmp() return buffer
  char		message[JMSG_LENGTH_MAX];
				// Last error message
} hd_jpeg_err_t;


  hd_jpeg_err_t			jerr;		// JPEG error handler
JSAMPROW			row;		/* Sample row pointer */
  jpeg_std_error(&jerr.jerr);
  jerr.jerr.error_exit = jpeg_error_handler;
  if (setjmp(jerr.retbuf))
  {
    progress_error(HD_ERROR_BAD_FORMAT, "%s (%s)", jerr.message,  file_rlookup(img->filename));
    jpeg_destroy_decompress(&cinfo);
    return (-1);
  }

  cinfo.err = (struct jpeg_error_mgr *)&jerr;
jpeg_error_handler(j_common_ptr p)	// Common JPEG data
  hd_jpeg_err_t	*jerr = (hd_jpeg_err_t *)p->err;
					// JPEG error handler


  // Save the error message in the string buffer...
  (jerr->jerr.format_message)(p, jerr->message);

  // Return to the point we called setjmp()...
  longjmp(jerr->retbuf, 1);
  if (page < 0 || page >= num_pages)
    return;
        if (chapter_starts[j] < 0)
          continue;
CVE-2021-23165 (Markdown, published 2022-03-16T15:15Z)
Description: value: A flaw was found in htmldoc before v1.9.12. Heap buffer overflow in pspdf_prepare_outpages(), in ps-pdf.cxx may lead to execute arbitrary code and denial of service.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/ps-pdf.cxx
Commit message: Fix a number-up crash bug (Issue #413)


Vulnerable code:
- Fixed JPEG error handling (Issue #415)
         i <= chapter_ends[c];

Fixed code:
- Fixed a number-up crash bug (Issue #413)
- Fixed JPEG error handling (Issue #414, Issue #415)
         i <= chapter_ends[c] && num_outpages < num_pages;
CVE-2021-23180 (C, published 2022-03-02T23:15Z)
Description: value: A flaw was found in htmldoc in v1.9.12 and before. Null pointer dereference in file_extension(),in file.c may lead to execute arbitrary code and denial of service.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/file.c
Commit message: Fix a crash bug with malformed URIs (Issue #418)


Vulnerable code:
  *(char *)strchr(buf, '#') = '\0';

Fixed code:
- Fixed a crash bug with malformed URIs (Issue #418)
  char		*bufptr;	/* Pointer into buffer */
  if ((bufptr = strchr(buf, '#')) != NULL)
    *bufptr = '\0';
CVE-2021-23191 (Other, published 2022-03-02T23:15Z)
Description: value: A security issue was found in htmldoc v1.9.12 and before. A NULL pointer dereference in the function image_load_jpeg() in image.cxx may result in denial of service.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/file.c
htmldoc/image.cxx
htmldoc/ps-pdf.cxx
Commit message: Fix JPEG error handling (Issue #415)


Vulnerable code:
      return (wc->url);
  struct jpeg_error_mgr		jerr;		/* Error handler info */
  JSAMPROW			row;		/* Sample row pointer */
  jpeg_std_error(&jerr);
  jerr.error_exit = jpeg_error_handler;
  cinfo.err = &jerr;
jpeg_error_handler(j_common_ptr)
  return;

Fixed code:
- Fixed JPEG error handling (Issue #415)
  {
    {
      if (!strncmp(wc->url, "data:", 5))
        return ("data URL");
      else
        return (wc->url);
    }
  }
typedef struct hd_jpeg_err_s	// JPEG error manager extension
{
  struct jpeg_error_mgr	jerr;	// JPEG error manager information
  jmp_buf	retbuf;		// setjmp() return buffer
  char		message[JMSG_LENGTH_MAX];
				// Last error message
} hd_jpeg_err_t;


  hd_jpeg_err_t			jerr;		// JPEG error handler
JSAMPROW			row;		/* Sample row pointer */
  jpeg_std_error(&jerr.jerr);
  jerr.jerr.error_exit = jpeg_error_handler;
  if (setjmp(jerr.retbuf))
  {
    progress_error(HD_ERROR_BAD_FORMAT, "%s (%s)", jerr.message,  file_rlookup(img->filename));
    jpeg_destroy_decompress(&cinfo);
    return (-1);
  }

  cinfo.err = (struct jpeg_error_mgr *)&jerr;
jpeg_error_handler(j_common_ptr p)	// Common JPEG data
  hd_jpeg_err_t	*jerr = (hd_jpeg_err_t *)p->err;
					// JPEG error handler


  // Save the error message in the string buffer...
  (jerr->jerr.format_message)(p, jerr->message);

  // Return to the point we called setjmp()...
  longjmp(jerr->retbuf, 1);
  if (page < 0 || page >= num_pages)
    return;
        if (chapter_starts[j] < 0)
          continue;
CVE-2021-23206 (Markdown, published 2022-03-02T23:15Z)
Description: value: A flaw was found in htmldoc in v1.9.12 and prior. A stack buffer overflow in parse_table() in ps-pdf.cxx may lead to execute arbitrary code and denial of service.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/ps-pdf.cxx
Commit message: Fix crash bugs with bogus table attributes (Issue #416)


Vulnerable code:
- Fixed a crach bug with bogus table attributes (Issue #417)
      if (table.row_spans[col] == 1)
            colspan = atoi((char *)var);
	    if (table.row_spans[col] == 1)

Fixed code:
- Fixed crash bugs with bogus table attributes (Issue #416, Issue #417)
      if (table.row_spans[col] <= 1)
          {
            if ((colspan = atoi((char *)var)) < 1)
              colspan = 1;
            else if (colspan > (MAX_COLUMNS - col))
              colspan = MAX_COLUMNS - col;
          }
	    if (table.row_spans[col] <= 1)

	    if (col_width <= 0.0f)
	      col_width = 0.0f;
	    else if (col_width > PageWidth)
	      col_width = PageWidth;
CVE-2021-26259 (Markdown, published 2022-03-03T23:15Z)
Description: value: A flaw was found in htmldoc in v1.9.12. Heap buffer overflow in render_table_row(),in ps-pdf.cxx may lead to arbitrary code execution and denial of service.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/ps-pdf.cxx
Commit message: Fix a crash bug with bogus table attributes (Issue #417)


Vulnerable code:
    table.cellpadding = atoi((char *)var);
    cellspacing = atoi((char *)var);
    if ((table.border = (float)atof((char *)var)) == 0.0 && var[0] != '0')
  cellspacing *= PagePrintWidth / _htmlBrowserWidth;

Fixed code:
- Fixed a crach bug with bogus table attributes (Issue #417)

    if (table_width < 0.0f || table_width > PagePrintWidth)
      table_width = right - left;
  {
    if ((table.cellpadding = atoi((char *)var)) < 0.0f)
      table.cellpadding = 0.0f;
    else if (table.cellpadding > 20.0f)
      table.cellpadding = 20.0f;
  }
  {
    if ((cellspacing = atoi((char *)var)) < 0.0f)
      cellspacing = 0.0f;
    else if (cellspacing > 20.0f)
      cellspacing = 20.0f;
  }
    if ((table.border = (float)atof((char *)var)) <= 0.0 && var[0] != '0')
    else if (table.border > 20.0f)
      table.border = 20.0f;
  cellspacing       *= PagePrintWidth / _htmlBrowserWidth;
CVE-2021-34119 (Markdown, published 2023-07-18T14:15Z)
Description: value: A flaw was discovered in htmodoc 1.9.12 in function parse_paragraph in ps-pdf.cxx ,this flaw possibly allows possible code execution and a denial of service via a crafted file.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/ps-pdf.cxx
Commit message: Fix another crash bug with bogus data (Issue #431)


Vulnerable code:
- Fixed a crash bug with bogus text (Issue #426)
	else if (prev->markup == MARKUP_NONE)

Fixed code:
- Fixed a crash bug with bogus text (Issue #426, Issue #431)
	else if (prev->markup == MARKUP_NONE && *(prev->data))
CVE-2021-40985 (Markdown, published 2021-11-03T17:15Z)
Description: value: A stack-based buffer under-read in htmldoc before 1.9.12, allows attackers to cause a denial of service via a crafted BMP image to image_load_bmp.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/image.cxx
Commit message: Fix BMP crash bug (Issue #444)


Vulnerable code:
  img->depth  = gray ? 1 : 3;
		temp = getc(fp);

Fixed code:
- Fixed a crash bug with bogus BMP images (Issue #444)
  if (img->width <= 0 || img->width > 8192 || img->height <= 0 || img->height > 8192)
    return (-1);

  img->depth = gray ? 1 : 3;
		temp = getc(fp) & 255;
CVE-2021-43579 (Markdown, published 2022-01-10T14:10Z)
Description: value: A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim converts an HTML document linking to a crafted BMP file.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/image.cxx
Commit message: Fix potential BMP stack overflow (Issue #453)


Vulnerable code:

Fixed code:
- Fixed a stack overflow bug with bogus BMP images (Issue #453)
  {
  }
  else if (colors_used > 256)
    return (-1);
CVE-2022-0137 (Markdown, published 2022-11-14T18:15Z)
Description: value: A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/image.cxx
Commit message: Fix potential heap overflow bug with GIF images (Issue #461)


Vulnerable code:
          img->width  = (buf[5] << 8) | buf[4];
          img->height = (buf[7] << 8) | buf[6];
          img->depth  = gray ? 1 : 3;

	  if (img->width <= 0 || img->width > 32767 || img->height <= 0 || img->height > 32767)
	    return (-1);

      y < 0 || y > img->height)

Fixed code:
# Changes in HTMLDOC v1.9.15

- Fixed a potential heap overflow bug with GIF images (Issue #461)


          img->width  = (buf[5] << 8) | buf[4];
          img->height = (buf[7] << 8) | buf[6];
          img->depth  = gray ? 1 : 3;

	  if (img->width <= 0 || img->width > 32767 || img->height <= 0 || img->height > 32767)
	    return (-1);

      y < 0 || y >= img->height)
CVE-2022-0534 (Other, published 2022-02-09T23:15Z)
Description: value: A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
htmldoc/image.cxx
Commit message: Block GIF images with a code size > 12 (Issue #463)


Vulnerable code:
  while ((code = gif_get_code (fp, code_size, 0)) >= 0)

Fixed code:
  if (code_size > 12)
  {
    progress_error(HD_ERROR_READ_ERROR, "Bad GIF file \"%s\" - invalid code size %d.", img->filename, code_size);
    return (-1);
  }

  while ((code = gif_get_code(fp, code_size, 0)) >= 0)
CVE-2022-27114 (Markdown, published 2022-05-09T17:15Z)
Description: value: There is a vulnerability in htmldoc 1.9.16. In image_load_jpeg function image.cxx when it calls malloc,'img->width' and 'img->height' they are large enough to cause an integer overflow. So, the malloc function may return a heap blosmaller than the expected size, and it will cause a buffer overflow/Address boundary error in the jpeg_read_scanlines function.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/image.cxx
Commit message: Fix a potential integer overflow bug in the JPEG and PNG loaders (Issue #471)

All images are now limited to 4GiB of memory usage (37837x37837 pixels).


Vulnerable code:
- Updated the GUI interface for current display fonts.
  if (img->width <= 0 || img->width > 8192 || img->height <= 0 || img->height > 8192 || info_size < 0)
  if (img->width <= 0 || img->width > 32767 || img->height <= 0 || img->height > 32767)
	  if (img->width <= 0 || img->width > 32767 || img->height <= 0 || img->height > 32767)

Fixed code:
- Fixed a potential image overflow bug with JPEG and PNG images (Issue #471)
- Updated the GUI interface for current display fonts.
/*
 * Limits...
 */

#define IMAGE_MAX_DIM	37837		// Maximum dimension - sqrt(4GiB / 3)


  if (img->width <= 0 || img->width > IMAGE_MAX_DIM || img->height <= 0 || img->height > IMAGE_MAX_DIM || info_size < 0)
  if (img->width <= 0 || img->width > IMAGE_MAX_DIM || img->height <= 0 || img->height > IMAGE_MAX_DIM)
	  if (img->width <= 0 || img->width > IMAGE_MAX_DIM || img->height <= 0 || img->height > IMAGE_MAX_DIM)
  if (img->width <= 0 || img->width > IMAGE_MAX_DIM || img->height <= 0 || img->height > IMAGE_MAX_DIM)
  {
    jpeg_destroy_decompress(&cinfo);
    return (-1);
  }

  if (img->width <= 0 || img->width > IMAGE_MAX_DIM || img->height <= 0 || img->height > IMAGE_MAX_DIM)
  {
    png_destroy_read_struct(&pp, &info, NULL);
    return (-1);
  }
CVE-2022-28085 (Other, published 2022-04-27T03:15Z)
Description: value: A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denial of Service (DoS).
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
htmldoc/ps-pdf.cxx
Commit message: Call check_pages when writing links (Issue #480)


Vulnerable code:

Fixed code:
    check_pages(link->page);
CVE-2022-34033 (Other, published 2022-07-18T21:15Z)
Description: value: HTMLDoc v1.9.15 was discovered to contain a heap overflow via (write_header) /htmldoc/htmldoc/html.cxx:273.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/html.cxx
htmldoc/htmllib.cxx
htmldoc/htmlsep.cxx
Commit message: Fix a crash bug with bogus text (Issue #426)


Vulnerable code:
 * Copyright 2011-2019 by Michael R Sweet.
	  if (t->data[strlen((char *)t->data) - 1] == '\n')
	if (t->data[strlen((char *)t->data) - 1] == '\n')
	  if (t->data[strlen((char *)t->data) - 1] == '\n')

Fixed code:
- Fixed a crash bug with bogus text (Issue #426)
 * Copyright 2011-2021 by Michael R Sweet.
	  if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
	if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
	  if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
CVE-2022-34033 (Other, published 2022-07-18T21:15Z)
Description: value: HTMLDoc v1.9.15 was discovered to contain a heap overflow via (write_header) /htmldoc/htmldoc/html.cxx:273.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/htmllib.cxx
htmldoc/testhtml.cxx
Commit message: Fix a crash bug with empty titles (Issue #425)


Vulnerable code:
 * Copyright 2011-2020 by Michael R Sweet.
    if (tdata != NULL)
      tlen = strlen((char *)tdata);

      if (talloc)
      {
	free(talloc);
	talloc = NULL;
      }
    else

Fixed code:
- Fixed a crash bug with empty titles (Issue #425)
 * Copyright 2011-2021 by Michael R Sweet.
    tlen = tdata ? strlen((char *)tdata) : 0;

    if (tdata != NULL && tlen > 0)
    }
    if (talloc)
    {
      free(talloc);
      talloc = NULL;
  static const char * const markups[] =
  {
    "FILE",
    "UNKNOWN",
    "ERROR"
  };

    else if (t->markup > MARKUP_NONE)
    else
      printf("%*s%s\n", indent, "", markups[t->markup - MARKUP_FILE]);
CVE-2022-34035 (Other, published 2022-07-18T21:15Z)
Description: value: HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e_node htmldoc/htmldoc/html.cxx:588.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/html.cxx
htmldoc/htmllib.cxx
htmldoc/htmlsep.cxx
Commit message: Fix a crash bug with bogus text (Issue #426)


Vulnerable code:
 * Copyright 2011-2019 by Michael R Sweet.
	  if (t->data[strlen((char *)t->data) - 1] == '\n')
	if (t->data[strlen((char *)t->data) - 1] == '\n')
	  if (t->data[strlen((char *)t->data) - 1] == '\n')

Fixed code:
- Fixed a crash bug with bogus text (Issue #426)
 * Copyright 2011-2021 by Michael R Sweet.
	  if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
	if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
	  if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
CVE-2022-34035 (Other, published 2022-07-18T21:15Z)
Description: value: HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e_node htmldoc/htmldoc/html.cxx:588.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/michaelrsweet/htmldoc
Files changed:
CHANGES.md
htmldoc/htmllib.cxx
htmldoc/testhtml.cxx
Commit message: Fix a crash bug with empty titles (Issue #425)


Vulnerable code:
 * Copyright 2011-2020 by Michael R Sweet.
    if (tdata != NULL)
      tlen = strlen((char *)tdata);

      if (talloc)
      {
	free(talloc);
	talloc = NULL;
      }
    else

Fixed code:
- Fixed a crash bug with empty titles (Issue #425)
 * Copyright 2011-2021 by Michael R Sweet.
    tlen = tdata ? strlen((char *)tdata) : 0;

    if (tdata != NULL && tlen > 0)
    }
    if (talloc)
    {
      free(talloc);
      talloc = NULL;
  static const char * const markups[] =
  {
    "FILE",
    "UNKNOWN",
    "ERROR"
  };

    else if (t->markup > MARKUP_NONE)
    else
      printf("%*s%s\n", indent, "", markups[t->markup - MARKUP_FILE]);
CVE-2022-1681 (JavaScript, published 2022-05-12T08:15Z)
Description: value: Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions
Severity: HIGH (CVSS v3 base score: 7.2)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/requarks/wiki
Files changed:
server/graph/resolvers/group.js
Commit message: fix: prevent manage system assignment from manage groups permission


Vulnerable code:

Fixed code:
      // Check assigned permissions for manage:groups
      if (
        WIKI.auth.checkExclusiveAccess(req.user, ['manage:groups'], ['manage:system']) &&
        args.permissions.some(p => _.last(p.split(':')) === 'system')
      ) {
        throw new gql.GraphQLError('You are not authorized to manage this group or assign the manage:system permissions.')
      }
CVE-2022-29527 (Go, published 2022-04-20T10:15Z)
Description: value: Amazon AWS amazon-ssm-agent before 3.1.1208.0 creates a world-writable sudoers file, which allows local attackers to inject Sudo rules and escalate privileges to root. This occurs in certain situations involving a race condition.
Severity: MEDIUM (CVSS v3 base score: 7)
Weakness: CWE-362 \u2014 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
Repository: https://github.com/aws/amazon-ssm-agent
Files changed:
agent/session/utility/utility_unix.go
Commit message: Create ssm-agent-users sudoer file with constrained file permission

cr: https://code.amazon.com/reviews/CR-67315538


Vulnerable code:
	sudoersFile     = "/etc/sudoers.d/ssm-agent-users"
	sudoersFileMode = 0440
	fs_ioc_getflags = uintptr(0x80086601)
	fs_ioc_setflags = uintptr(0x40086602)
	FS_APPEND_FL    = 0x00000020 /* writes to file may only append */
	FS_RESET_FL     = 0x00000000 /* reset file property */
	// Create a sudoers file for ssm-user
	file, err := os.Create(sudoersFile)
	fileMode := os.FileMode(sudoersFileMode)
		log.Errorf("Failed to change mode of %s to %d: %v", sudoersFile, sudoersFileMode, err)
	log.Infof("Successfully changed mode of %s to %d", sudoersFile, sudoersFileMode)

Fixed code:
	sudoersFile                = "/etc/sudoers.d/ssm-agent-users"
	sudoersFileCreateWriteMode = 0640
	sudoersFileReadOnlyMode    = 0440
	fs_ioc_getflags            = uintptr(0x80086601)
	fs_ioc_setflags            = uintptr(0x40086602)
	FS_APPEND_FL               = 0x00000020 /* writes to file may only append */
	FS_RESET_FL                = 0x00000000 /* reset file property */
	// Create a sudoers file for ssm-user with read/write access
	file, err := os.OpenFile(sudoersFile, os.O_WRONLY|os.O_CREATE, sudoersFileCreateWriteMode)
	fileMode := os.FileMode(sudoersFileReadOnlyMode)
		log.Errorf("Failed to change mode of %s to %d: %v", sudoersFile, sudoersFileReadOnlyMode, err)
	log.Infof("Successfully changed mode of %s to %d", sudoersFile, sudoersFileReadOnlyMode)