hitoshura25/cvefixes huggingface dataset:
CVE-2023-47641 (Python, published 2023-11-14T21:15Z)
Description: value: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the inconsistent interpretation of the http protocol. HTTP/1.1 is a persistent protocol, if both Content-Length(CL) and Transfer-Encoding(TE) header values are present it can lead to incorrect interpretation of two entities that parse the HTTP and we can poison other sockets with this incorrect interpretation. A possible Proof-of-Concept (POC) would be a configuration with a reverse proxy(frontend) that accepts both CL and TE headers and aiohttp as backend. As aiohttp parses anything with chunked, we can pass a chunked123 as TE, the frontend entity will ignore this header and will parse Content-Length. The impact of this vulnerability is that it is possible to bypass any proxy rule, poisoning sockets to other users like passing Authentication Headers, also if it is present an Open Redirect an attacker could combine it to redirect random users to another website and log the request. This vulnerability has been addressed in release 3.8.0 of aiohttp. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Severity: nan (CVSS v3 base score: 6.5)
Weakness: CWE-444 \u2014 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent
         (such as a proxy or firewall) in the data flow between two
         entities such as a client and server, but it does not
         interpret malformed HTTP requests or responses in ways that
         are consistent with how the messages will be processed by
         those entities that are at the ultimate destination.
Repository: https://github.com/aio-libs/aiohttp
Files changed:
CHANGES/6182.bugfix
aiohttp/http_parser.py
tests/test_http_parser.py
Commit message: Raise '400: Content-Length can't be present with Transfer-Encoding' if both Content-Length and Transfer-Encoding are sent by peer (#6182)


Vulnerable code:
        if te and "chunked" in te.lower():
            chunked = True
def test_conn_upgrade(parser) -> None:

Fixed code:
Raise ``400: Content-Length can't be present with Transfer-Encoding`` if both ``Content-Length`` and ``Transfer-Encoding`` are sent by peer by both C and Python implementations
    BadHttpMessage,
        if te is not None:
            te_lower = te.lower()
            if "chunked" in te_lower:
                chunked = True

            if hdrs.CONTENT_LENGTH in headers:
                raise BadHttpMessage(
                    "Content-Length can't be present with Transfer-Encoding",
                )
def test_request_te_chunked_with_content_length(parser: Any) -> None:
    text = (
        b"GET /test HTTP/1.1\r\n"
        b"content-length: 1234\r\n"
        b"transfer-encoding: chunked\r\n\r\n"
    )
    with pytest.raises(
        http_exceptions.BadHttpMessage,
        match="Content-Length can't be present with Transfer-Encoding",
    ):
        parser.feed_data(text)


def test_conn_upgrade(parser: Any) -> None:
CVE-2023-49081 (Python, published 2023-11-30T07:15Z)
Description: value: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the attacker can control the HTTP version of the request. This issue has been patched in version 3.9.0.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/aio-libs/aiohttp
Files changed:
CHANGES/7835.bugfix
aiohttp/client_reqrep.py
tests/test_client_request.py
Commit message: Disallow arbitrary sequence types in version (#7835)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>

Vulnerable code:
        status_line = "{0} {1} HTTP/{2[0]}.{2[1]}".format(
            self.method, path, self.version
    req.version = (1, 1)
    req.version = (1, 0)
    req.version = (1, 1)

Fixed code:
Fixed arbitrary sequence types being allowed to inject headers via version parameter -- by :user:`Dreamsorcerer`
        status_line = "{0} {1} HTTP/{v.major}.{v.minor}".format(
            self.method, path, v=self.version
from aiohttp.http import HttpVersion
    req.version = HttpVersion(1, 1)
    req.version = HttpVersion(1, 0)
    req.version = HttpVersion(1, 1)
async def test_bad_version(loop: Any, conn: Any) -> None:
    req = ClientRequest(
        "GET",
        URL("http://python.org"),
        loop=loop,
        headers={"Connection": "Close"},
        version=("1", "1\r\nInjected-Header: not allowed"),
    )

    with pytest.raises(AttributeError):
        await req.send(conn)
CVE-2023-49082 (Python, published 2023-11-29T20:15Z)
Description: value: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/aio-libs/aiohttp
Files changed:
CHANGES/6533.feature
aiohttp/client_reqrep.py
tests/test_client_request.py
tests/test_web_request.py
Commit message: Add HTTP method validation (#6533) (#7806)

(cherry picked from commit 75fca0b00b4297d0a30c51ae97a65428336eb2c1)

Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>

Vulnerable code:

    assert req.host == socket.getfqdn()
    assert req.host.lower() == socket.getfqdn().lower()

Fixed code:
Add HTTP method validation.
_CONTAINS_CONTROL_CHAR_RE = re.compile(r"[^-!#$%&'*+.^_`|~0-9a-zA-Z]")
        match = _CONTAINS_CONTROL_CHAR_RE.search(method)
        if match:
            raise ValueError(
                f"Method cannot contain non-token characters {method!r} "
                "(found at least {match.group()!r})"
            )

def test_method_invalid(make_request) -> None:
    with pytest.raises(ValueError, match="Method cannot contain non-token characters"):
        make_request("METHOD WITH\nWHITESPACES", "http://python.org/")


    # MacOS may return CamelCased host name, need .lower()
    # FQDN can be wider than host, e.g.
    # 'fv-az397-495' in 'fv-az397-495.internal.cloudapp.net'
    assert req.host.lower() in socket.getfqdn().lower()
    # FQDN can be wider than host, e.g.
    # 'fv-az397-495' in 'fv-az397-495.internal.cloudapp.net'
    assert req.host.lower() in socket.getfqdn().lower()
CVE-2023-49082 (Python, published 2023-11-29T20:15Z)
Description: value: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker controls the HTTP method. The vulnerability occurs only if the attacker can control the HTTP method (GET, POST etc.) of the request. If the attacker can control the HTTP version of the request it will be able to modify the request (request smuggling). This issue has been patched in version 3.9.0.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-93 \u2014 Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Repository: https://github.com/aio-libs/aiohttp
Files changed:
CHANGES/6533.feature
aiohttp/client_reqrep.py
tests/test_client_request.py
tests/test_web_request.py
Commit message: Add HTTP method validation (#6533) (#7806)

(cherry picked from commit 75fca0b00b4297d0a30c51ae97a65428336eb2c1)

Co-authored-by: Andrew Svetlov <andrew.svetlov@gmail.com>

Vulnerable code:

    assert req.host == socket.getfqdn()
    assert req.host.lower() == socket.getfqdn().lower()

Fixed code:
Add HTTP method validation.
_CONTAINS_CONTROL_CHAR_RE = re.compile(r"[^-!#$%&'*+.^_`|~0-9a-zA-Z]")
        match = _CONTAINS_CONTROL_CHAR_RE.search(method)
        if match:
            raise ValueError(
                f"Method cannot contain non-token characters {method!r} "
                "(found at least {match.group()!r})"
            )

def test_method_invalid(make_request) -> None:
    with pytest.raises(ValueError, match="Method cannot contain non-token characters"):
        make_request("METHOD WITH\nWHITESPACES", "http://python.org/")


    # MacOS may return CamelCased host name, need .lower()
    # FQDN can be wider than host, e.g.
    # 'fv-az397-495' in 'fv-az397-495.internal.cloudapp.net'
    assert req.host.lower() in socket.getfqdn().lower()
    # FQDN can be wider than host, e.g.
    # 'fv-az397-495' in 'fv-az397-495.internal.cloudapp.net'
    assert req.host.lower() in socket.getfqdn().lower()
CVE-2024-30251 (Python, published 2024-05-02T14:15Z)
Description: value: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/aio-libs/aiohttp
Files changed:
CHANGES/8332.bugfix.rst
aiohttp/multipart.py
tests/test_multipart.py
Commit message: [PR #8332/482e6cdf backport][3.9] Add set_content_disposition test (#8333)

**This is a backport of PR #8332 as merged into master
(482e6cdf6516607360666a48c5828d3dbe959fbd).**

Co-authored-by: Oleg A <t0rr@mail.ru>

Vulnerable code:
            assert CONTENT_DISPOSITION in payload.headers
            assert "name=" in payload.headers[CONTENT_DISPOSITION]

Fixed code:
Fixed regression with adding Content-Disposition to form-data part after appending to writer -- by :user:`Dreamsorcerer`/:user:`Olegt0rr`.
            if self._is_form_data:
                # https://datatracker.ietf.org/doc/html/rfc7578#section-4.2
                assert CONTENT_DISPOSITION in part.headers
                assert "name=" in part.headers[CONTENT_DISPOSITION]

    async def test_set_content_disposition_after_append(self):
        writer = aiohttp.MultipartWriter("form-data")
        payload = writer.append("some-data")
        payload.set_content_disposition("form-data", name="method")
        assert CONTENT_DISPOSITION in payload.headers
        assert "name=" in payload.headers[CONTENT_DISPOSITION]
CVE-2024-30251 (Python, published 2024-05-02T14:15Z)
Description: value: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST (multipart/form-data) request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further requests. An attacker can stop the application from serving requests after sending a single request. This issue has been addressed in version 3.9.4. Users are advised to upgrade. Users unable to upgrade may manually apply a patch to their systems. Please see the linked GHSA for instructions.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/aio-libs/aiohttp
Files changed:
CHANGES/8335.bugfix.rst
aiohttp/multipart.py
tests/test_multipart.py
Commit message: [PR #8335/5a6949da backport][3.9] Add Content-Disposition automatically (#8336)

**This is a backport of PR #8335 as merged into master
(5a6949da642d1db6cf414fd0d1f70e54c7b7be14).**

Co-authored-by: Sam Bull <git@sambull.org>

Vulnerable code:
    async def test_set_content_disposition_after_append(self):
        payload = writer.append("some-data")
        payload.set_content_disposition("form-data", name="method")
        assert CONTENT_DISPOSITION in payload.headers
        assert "name=" in payload.headers[CONTENT_DISPOSITION]

Fixed code:
Added default Content-Disposition in multipart/form-data responses -- by :user:`Dreamsorcerer`.
            # Set default Content-Disposition in case user doesn't create one
            if CONTENT_DISPOSITION not in payload.headers:
                name = f"section-{len(self._parts)}"
                payload.set_content_disposition("form-data", name=name)
    def test_set_content_disposition_after_append(self):
        part = writer.append("some-data")
        part.set_content_disposition("form-data", name="method")
        assert 'name="method"' in part.headers[CONTENT_DISPOSITION]

    def test_automatic_content_disposition(self):
        writer = aiohttp.MultipartWriter("form-data")
        writer.append_json(())
        part = payload.StringPayload("foo")
        part.set_content_disposition("form-data", name="second")
        writer.append_payload(part)
        writer.append("foo")

        disps = tuple(p[0].headers[CONTENT_DISPOSITION] for p in writer._parts)
        assert 'name="section-0"' in disps[0]
        assert 'name="second"' in disps[1]
        assert 'name="section-2"' in disps[2]
CVE-2022-1849 (PHP, published 2022-05-24T16:15Z)
Description: value: Session Fixation in GitHub repository filegator/filegator prior to 7.8.0.
Severity: MEDIUM (CVSS v3 base score: 5.4)
Weakness: CWE-384 \u2014 Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
Repository: https://github.com/filegator/filegator
Files changed:
backend/Services/Auth/Adapters/JsonFile.php
Commit message: regenerate session on user update


Vulnerable code:
                if ($u['username'] == $user->getUsername() && $hash == $u['password']) {
                $this->session->set(self::SESSION_HASH, $u['password']);

Fixed code:
                if ($u['username'] == $user->getUsername() && $hash == $u['password'].$u['permissions'].$u['homedir'].$u['role']) {
                $this->session->set(self::SESSION_HASH, $u['password'].$u['permissions'].$u['homedir'].$u['role']);
CVE-2022-1850 (PHP, published 2022-05-24T15:15Z)
Description: value: Path Traversal in GitHub repository filegator/filegator prior to 7.8.0.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/filegator/filegator
Files changed:
backend/Services/Storage/Filesystem.php
tests/backend/Unit/FilesystemTest.php
Commit message: path traversal fix


Vulnerable code:

Fixed code:

        $path1 = $this->escapeDots($path1);
        $path2 = $this->escapeDots($path2);


    private function escapeDots(string $path): string
    {
        $path = preg_replace('/\\\+\.{2,}/', '', $path);
        $path = preg_replace('/\.{2,}\\\+/', '', $path);
        $path = preg_replace('/\/+\.{2,}/', '', $path);
        $path = preg_replace('/\.{2,}\/+/', '', $path);

        return $path;
    }
        $this->assertEquals('/john/', $this->invokeMethod($this->storage, 'applyPathPrefix', ['..\\']));
        $this->assertEquals('/john/', $this->invokeMethod($this->storage, 'applyPathPrefix', ['..\\\\']));
        $this->assertEquals('/john/', $this->invokeMethod($this->storage, 'applyPathPrefix', ['..\\..\\']));
        $this->assertEquals('/john/', $this->invokeMethod($this->storage, 'applyPathPrefix', ['\\\\..']));
        $this->assertEquals('/john/', $this->invokeMethod($this->storage, 'applyPathPrefix', ['\\..\\..']));
        $this->assertEquals('/john/\\.', $this->invokeMethod($this->storage, 'applyPathPrefix', ['\\.\\...']));
        $this->assertEquals('/john/\\.', $this->invokeMethod($this->storage, 'applyPathPrefix', ['\\.\\....']));
        $this->assertEquals('/john/.\\.', $this->invokeMethod($this->storage, 'applyPathPrefix', ['.\\.\\...']));
        $this->assertEquals('/john/.', $this->invokeMethod($this->storage, 'applyPathPrefix', ['..\\.\\...']));
        $this->assertEquals('/john/.', $this->invokeMethod($this->storage, 'applyPathPrefix', ['..\\.\\...']));
        $this->assertEquals('/john/.', $this->invokeMethod($this->storage, 'applyPathPrefix', ['..\\.\\......']));
        $this->assertEquals('/john/.\\', $this->invokeMethod($this->storage, 'applyPathPrefix', ['...\\.\\......\\']));
CVE-2015-10120 (PHP, published 2023-07-10T16:15Z)
Description: value: A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the function update_options of the file includes/WDS_Multisite_Aggregate_Options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 49e0bbcb6ff70e561365d9e0d26426598f63ca12. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-233364.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/wp-plugins/wds-multisite-aggregate
Files changed:
includes/WDS_Multisite_Aggregate_Options.php
readme.md
readme.txt
wds-multisite-aggregate.php
Commit message: Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage

git-svn-id: https://plugins.svn.wordpress.org/wds-multisite-aggregate/trunk@1139353 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
			wp_redirect( add_query_arg( array( 'updated' => '1' ) ) );
		wp_redirect( add_query_arg( array( 'updated' => '1' ) ) );
**Tested up to:** 3.8.1  
**Stable tag:** 1.0.0  
Tested up to: 3.8.1
Stable tag: 1.0.0
Version: 1.0.0

Fixed code:
			wp_redirect( esc_url_raw( add_query_arg( array( 'updated' => '1' ) ) ) );
		wp_redirect( esc_url_raw( add_query_arg( array( 'updated' => '1' ) ) ) );
**Tested up to:** 4.2  
**Stable tag:** 1.0.1  
### 1.0.1 ###
* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage

Tested up to: 4.2
Stable tag: 1.0.1
= 1.0.1 =
* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage

= 1.0.0 =
* Forked from 'MU Sitewide Tags' and rewritten with OOP principles, WordPress coding standards, and extensibility in mind.

= 0.4.2 =
* duplicate category fix
* page permalink fix
* thumbnail size filter

= 0.4.1.1 =
* Run populate feature in source blog context.
* Added resource warning for populate feature.
* Fixed PHP warnings.
* Only insert categories for published posts.

= 0.4.1 =
* Move SWT admin to its own screen.
* Added thumbnail support.
* Added custom taxonomy (including post formats) support.
* Update admin screens for WordPress 3.1.

= 0.4.0.1 =
* Bug fix - only push published content to the tags blog

= 0.4 =
* Added option to include pages in tags blog.
* Added option to include non search engine indexed blogs if tags blog not indexed.
* Added option for post meta to be copied with post.

== Upgrade Notice ==

= 1.0.1 =
* Update for xss vulnerability, https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage


Version: 1.0.1
CVE-2018-1002203 (Unknown, published 2018-07-25T17:29Z)
Description: value: unzipper npm library before 0.8.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Severity: MEDIUM (CVSS v3 base score: 5.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/ZJONSSON/node-unzipper
Files changed:
Commit message: Merge pull request #59 from aviadatsnyk/fix/zip-slip

fix: prevent extracting archived files outside of target path

Vulnerable code:

Fixed code: