hitoshura25/cvefixes huggingface dataset:
CVE-2019-8460 (C, published 2019-08-26T20:15Z)
Description: value: OpenBSD kernel version <= 6.5 can be forced to create long chains of TCP SACK holes that causes very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/openbsd/src
Files changed:
sys/netinet/tcp.h
sys/netinet/tcp_input.c
Commit message: Received SACK options are managed by a linked list at the TCP socket.
There is a global tunable limit net.inet.tcp.sackholelimit, default
is 32768.  If an attacker manages to attach all these sack holes
to a few TCP connections, the lists may grow long.  Traversing them
might cause higher CPU consumption on the victim machine.  In
practice such a situation is hard to create as the TCP retransmit
and 2*msl timer flush the list periodically.  For additional
protection, enforce a per connection limit of 128 SACK holes in the
list.
reported by Reuven Plevinsky and Tal Vainshtein
discussed with claudio@ and procter@; OK deraadt@


Vulnerable code:
/*	$OpenBSD: tcp.h,v 1.20 2013/08/12 21:57:16 bluhm Exp $	*/
#define	TCP_MAX_SACK	3	/* MAX # SACKs sent in any segment */
/*	$OpenBSD: tcp_input.c,v 1.359 2018/09/17 14:07:48 friehm Exp $	*/

Fixed code:
/*	$OpenBSD: tcp.h,v 1.21 2019/07/10 18:45:31 bluhm Exp $	*/
#define	TCP_MAX_SACK	3	/* Max # SACKs sent in any segment */
#define	TCP_SACKHOLE_LIMIT 128	/* Max # SACK holes per connection */
/*	$OpenBSD: tcp_input.c,v 1.360 2019/07/10 18:45:31 bluhm Exp $	*/
				if (tp->snd_numholes >= TCP_SACKHOLE_LIMIT)
					goto done;
			if (tp->snd_numholes >= TCP_SACKHOLE_LIMIT)
				goto done;
CVE-2020-16088 (C, published 2020-07-28T12:15Z)
Description: value: iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/openbsd/src
Files changed:
sbin/iked/ca.c
Commit message: Fix return value check for openssl API used during pubkey validation.

Found thanks to bug report by Michael Scheibel <m.Scheibel (at) tuvit (dot) de>
ok patrick@, markus@, tb@


Vulnerable code:
/*	$OpenBSD: ca.c,v 1.64 2020/07/15 14:45:15 tobhe Exp $	*/
	if (peerkey && !EVP_PKEY_cmp(peerkey, localkey)) {

Fixed code:
/*	$OpenBSD: ca.c,v 1.65 2020/07/27 14:22:53 tobhe Exp $	*/
	if (peerkey && EVP_PKEY_cmp(peerkey, localkey) != 1) {
CVE-2020-35679 (C, published 2020-12-24T16:15Z)
Description: value: smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very significant" memory leak via messages to an instance that performs many regex lookups.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-401 \u2014 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
Repository: https://github.com/openbsd/src
Files changed:
usr.sbin/smtpd/table.c
Commit message: Use regfree after we're done with preg.

From gilles@


Vulnerable code:
/*	$OpenBSD: table.c,v 1.48 2019/01/10 07:40:52 eric Exp $	*/
	if (regexec(&preg, string, 0, NULL, 0) != 0)

Fixed code:
/*	$OpenBSD: table.c,v 1.49 2020/12/23 08:12:14 martijn Exp $	*/
	int ret;
	ret = regexec(&preg, string, 0, NULL, 0);

	regfree(&preg);

	if (ret != 0)
CVE-2020-7247 (C, published 2020-01-29T16:15Z)
Description: value: smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/openbsd/src
Files changed:
usr.sbin/smtpd/smtp_session.c
Commit message: Fix a security vulnerability discovered by Qualys which can lead to a
privileges escalation on mbox deliveries and unprivileged code execution
on lmtp deliveries, due to a logic issue causing a sanity check to be
missed.

ok eric@, millert@


Vulnerable code:
/*	$OpenBSD: smtp_session.c,v 1.421 2020/01/08 00:05:38 gilles Exp $	*/
	if (!valid_localpart(maddr->user) ||
	    !valid_domainpart(maddr->domain)) {
		/* accept empty return-path in MAIL FROM, required for bounces */
		if (mailfrom && maddr->user[0] == '\0' && maddr->domain[0] == '\0')
			return (1);
		/* no user-part, reject */
		if (maddr->user[0] == '\0')
			return (0);

		/* no domain, local user */
		if (maddr->domain[0] == '\0') {
			(void)strlcpy(maddr->domain, domain,
			    sizeof(maddr->domain));
			return (1);
		}

Fixed code:
/*	$OpenBSD: smtp_session.c,v 1.422 2020/01/28 21:35:00 gilles Exp $	*/
	/* accept empty return-path in MAIL FROM, required for bounces */
	if (mailfrom && maddr->user[0] == '\0' && maddr->domain[0] == '\0')
		return (1);
	/* no or invalid user-part, reject */
	if (maddr->user[0] == '\0' || !valid_localpart(maddr->user))

	/* no domain part, local user */
	if (maddr->domain[0] == '\0') {
		(void)strlcpy(maddr->domain, domain,
			sizeof(maddr->domain));
	if (!valid_domainpart(maddr->domain))
		return (0);
CVE-2020-7247 (C, published 2020-01-29T16:15Z)
Description: value: smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the "uncommented" default configuration. The issue exists because of an incorrect return value upon failure of input validation.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Repository: https://github.com/openbsd/src
Files changed:
usr.sbin/smtpd/smtp_session.c
Commit message: Fix a security vulnerability discovered by Qualys which can lead to a
privileges escalation on mbox deliveries and unprivileged code execution
on lmtp deliveries, due to a logic issue causing a sanity check to be
missed.

ok eric@, millert@


Vulnerable code:
/*	$OpenBSD: smtp_session.c,v 1.421 2020/01/08 00:05:38 gilles Exp $	*/
	if (!valid_localpart(maddr->user) ||
	    !valid_domainpart(maddr->domain)) {
		/* accept empty return-path in MAIL FROM, required for bounces */
		if (mailfrom && maddr->user[0] == '\0' && maddr->domain[0] == '\0')
			return (1);
		/* no user-part, reject */
		if (maddr->user[0] == '\0')
			return (0);

		/* no domain, local user */
		if (maddr->domain[0] == '\0') {
			(void)strlcpy(maddr->domain, domain,
			    sizeof(maddr->domain));
			return (1);
		}

Fixed code:
/*	$OpenBSD: smtp_session.c,v 1.422 2020/01/28 21:35:00 gilles Exp $	*/
	/* accept empty return-path in MAIL FROM, required for bounces */
	if (mailfrom && maddr->user[0] == '\0' && maddr->domain[0] == '\0')
		return (1);
	/* no or invalid user-part, reject */
	if (maddr->user[0] == '\0' || !valid_localpart(maddr->user))

	/* no domain part, local user */
	if (maddr->domain[0] == '\0') {
		(void)strlcpy(maddr->domain, domain,
			sizeof(maddr->domain));
	if (!valid_domainpart(maddr->domain))
		return (0);
CVE-2023-38408 (Other, published 2023-07-20T03:15Z)
Description: value: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-428 \u2014 Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
Repository: https://github.com/openbsd/src
Files changed:
usr.bin/ssh/ssh-agent.1
usr.bin/ssh/ssh-agent.c
Commit message: Disallow remote addition of FIDO/PKCS11 provider libraries to
ssh-agent by default.

The old behaviour of allowing remote clients from loading providers
can be restored using `ssh-agent -O allow-remote-pkcs11`.

Detection of local/remote clients requires a ssh(1) that supports
the `session-bind@openssh.com` extension. Forwarding access to a
ssh-agent socket using non-OpenSSH tools may circumvent this control.

ok markus@


Vulnerable code:
.\" $OpenBSD: ssh-agent.1,v 1.75 2022/10/07 06:00:58 jmc Exp $
.Dd $Mdocdate: October 7 2022 $
Currently only one option is supported:
This instructs
/* $OpenBSD: ssh-agent.c,v 1.299 2023/07/10 04:51:26 djm Exp $ */
				restrict_websafe  = 0;

Fixed code:
.\" $OpenBSD: ssh-agent.1,v 1.76 2023/07/19 13:56:33 djm Exp $
.Dd $Mdocdate: July 19 2023 $
Currently two options are supported:
.Cm allow-remote-pkcs11
and
.Pp
The
.Cm allow-remote-pkcs11
option allows clients of a forwarded
.Nm
to load PKCS#11 or FIDO provider libraries.
By default only local clients may perform this operation.
Note that signalling that a
.Nm
client remote is performed by
.Xr ssh 1 ,
and use of other tools to forward access to the agent socket may circumvent
this restriction.
.Pp
The
.Cm no-restrict-websafe ,
instructs
/* $OpenBSD: ssh-agent.c,v 1.300 2023/07/19 13:56:33 djm Exp $ */
/*
 * Allows PKCS11 providers or SK keys that use non-internal providers to
 * be added over a remote connection (identified by session-bind@openssh.com).
 */
static int remote_add_provider;

			if (e->nsession_ids != 0 && !remote_add_provider) {
				verbose("failed add of SK provider \"%.100s\": "
				    "remote addition of providers is disabled",
				    sk_provider);
				goto out;
			}
	if (e->nsession_ids != 0 && !remote_add_provider) {
		verbose("failed PKCS#11 add of \"%.100s\": remote addition of "
		    "providers is disabled", provider);
		goto send;
	}
				restrict_websafe = 0;
			else if (strcmp(optarg, "allow-remote-pkcs11") == 0)
				remote_add_provider = 1;
CVE-2023-38408 (C, published 2023-07-20T03:15Z)
Description: value: The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system. (Code in /usr/lib is not necessarily safe for loading into ssh-agent.) NOTE: this issue exists because of an incomplete fix for CVE-2016-10009.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-428 \u2014 Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
Repository: https://github.com/openbsd/src
Files changed:
usr.bin/ssh/ssh-pkcs11.c
Commit message: terminate process if requested to load a PKCS#11 provider that
isn't a PKCS#11 provider; from / ok markus@


Vulnerable code:
/* $OpenBSD: ssh-pkcs11.c,v 1.56 2023/03/08 05:33:53 tb Exp $ */
	if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL) {
		error("dlsym(C_GetFunctionList) failed: %s", dlerror());
		goto fail;
	}

Fixed code:
/* $OpenBSD: ssh-pkcs11.c,v 1.57 2023/07/19 13:55:53 djm Exp $ */
	if ((getfunctionlist = dlsym(handle, "C_GetFunctionList")) == NULL)
		fatal("dlsym(C_GetFunctionList) failed: %s", dlerror());
CVE-2023-40216 (C, published 2023-08-10T16:15Z)
Description: value: OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences.
Severity: nan (CVSS v3 base score: 5.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/openbsd/src
Files changed:
sys/dev/wscons/wsemul_sun.c
sys/dev/wscons/wsemul_vt100.c
Commit message: Make sure we do not increase the escape sequence argument count beyond usable
bounds, in case escape sequences end up with too many semicolons.
Without this, the kernel could be made to access random memory after receiving
some specially crafted DCS or CSI terminal escape sequences.

Reported by David Leadbeater (dgl, dgl dot cx)


Vulnerable code:
/* $OpenBSD: wsemul_sun.c,v 1.36 2023/03/06 20:34:35 miod Exp $ */
		edp->nargs++;
		oargs = edp->nargs++;
		if (edp->nargs > SUN_EMUL_NARGS)
			edp->nargs = SUN_EMUL_NARGS;
/* $OpenBSD: wsemul_vt100.c,v 1.45 2023/03/06 20:34:35 miod Exp $ */
		edp->nargs++;
		edp->nargs++;
		if (edp->nargs > VT100_EMUL_NARGS) {
#ifdef VT100_DEBUG
			printf("vt100: too many arguments\n");
#endif
			edp->nargs = VT100_EMUL_NARGS;
		}
		edp->nargs++;
		oargs = edp->nargs++;
		if (edp->nargs > VT100_EMUL_NARGS) {
#ifdef VT100_DEBUG
			printf("vt100: too many arguments\n");
#endif
			edp->nargs = VT100_EMUL_NARGS;
		}

Fixed code:
/* $OpenBSD: wsemul_sun.c,v 1.37 2023/07/24 17:03:32 miod Exp $ */
		if (edp->nargs < SUN_EMUL_NARGS)
			edp->nargs++;
		oargs = edp->nargs;
		if (edp->nargs < SUN_EMUL_NARGS)
			edp->nargs++;
/* $OpenBSD: wsemul_vt100.c,v 1.46 2023/07/24 17:03:32 miod Exp $ */
		if (edp->nargs < VT100_EMUL_NARGS)
			edp->nargs++;
		if (edp->nargs < VT100_EMUL_NARGS)
			edp->nargs++;
		if (edp->nargs < VT100_EMUL_NARGS)
			edp->nargs++;
		oargs = edp->nargs;
		if (edp->nargs < VT100_EMUL_NARGS)
			edp->nargs++;
CVE-2023-52556 (C, published 2024-03-01T17:15Z)
Description: value: In OpenBSD 7.4 before errata 009, a race condition between pf(4)'s processing of packets and expiration of packet states may cause a kernel panic.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/openbsd/src
Files changed:
sys/net/pf.c
Commit message: Prevent race between pf_test() and pf_purge_expired_states().
Packets (callers to pf_test()) must alter pf_state::timeout
under protection of pf_state::mtx. We also have to make sure
the packet does not update pf_state::timeout when ::timeout
reaches PFTM_UNLINKED.

The first report came from Johan Huldtgren, but he is not
the single user who has noticed "st->timeout == PFTM_UNLINKED"
assert violation.

OK bluhm@


Vulnerable code:
/*	$OpenBSD: pf.c,v 1.1188 2023/10/10 16:26:06 bluhm Exp $ */
					st->timeout = PFTM_PURGE;
	(*stp)->timeout = PFTM_PURGE;
	if (st->timeout == PFTM_UNLINKED)

					sist->timeout = PFTM_TCP_CLOSED;
			(*stp)->timeout = PFTM_TCP_CLOSED;
			(*stp)->timeout = PFTM_TCP_FIN_WAIT;
			(*stp)->timeout = PFTM_TCP_OPENING;
			(*stp)->timeout = PFTM_TCP_CLOSING;
			(*stp)->timeout = PFTM_TCP_ESTABLISHED;
		(*stp)->timeout = PFTM_TCP_CLOSED;
		(*stp)->timeout = PFTM_TCP_FIN_WAIT;
		(*stp)->timeout = PFTM_TCP_OPENING;
		(*stp)->timeout = PFTM_TCP_CLOSING;
		(*stp)->timeout = PFTM_TCP_ESTABLISHED;
				(*stp)->timeout = PFTM_PURGE;
			(*stp)->timeout = PFTM_UDP_MULTIPLE;
			(*stp)->timeout = PFTM_UDP_SINGLE;
			(*stp)->timeout = PFTM_OTHER_MULTIPLE;
			(*stp)->timeout = PFTM_OTHER_SINGLE;
		(*stp)->timeout = PFTM_ICMP_ERROR_REPLY;

Fixed code:
/*	$OpenBSD: pf.c,v 1.1189 2023/12/01 10:28:32 sashan Exp $ */
void
pf_update_state_timeout(struct pf_state *st, int to)
{
	mtx_enter(&st->mtx);
	if (st->timeout != PFTM_UNLINKED)
		st->timeout = to;
	mtx_leave(&st->mtx);
}

					pf_update_state_timeout(st, PFTM_PURGE);
	pf_update_state_timeout(*stp, PFTM_PURGE);
	mtx_enter(&st->mtx);
	if (st->timeout == PFTM_UNLINKED) {
		mtx_leave(&st->mtx);
	}
	mtx_leave(&st->mtx);
					pf_update_state_timeout(sist,
					    PFTM_TCP_CLOSED);
			pf_update_state_timeout(*stp, PFTM_TCP_CLOSED);
			pf_update_state_timeout(*stp, PFTM_TCP_FIN_WAIT);
			pf_update_state_timeout(*stp, PFTM_TCP_OPENING);
			pf_update_state_timeout(*stp, PFTM_TCP_CLOSING);
			pf_update_state_timeout(*stp, PFTM_TCP_ESTABLISHED);
		pf_update_state_timeout(*stp, PFTM_TCP_CLOSED);
		pf_update_state_timeout(*stp, PFTM_TCP_FIN_WAIT);
		pf_update_state_timeout(*stp, PFTM_TCP_OPENING);
		pf_update_state_timeout(*stp, PFTM_TCP_CLOSING);
		pf_update_state_timeout(*stp, PFTM_TCP_ESTABLISHED);
				pf_update_state_timeout(*stp, PFTM_PURGE);
			pf_update_state_timeout(*stp, PFTM_UDP_MULTIPLE);
			pf_update_state_timeout(*stp, PFTM_UDP_SINGLE);
			pf_update_state_timeout(*stp, PFTM_OTHER_MULTIPLE);
			pf_update_state_timeout(*stp, PFTM_OTHER_SINGLE);
		pf_update_state_timeout(*stp, PFTM_ICMP_ERROR_REPLY);
CVE-2023-52557 (C, published 2024-03-01T17:15Z)
Description: value: In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/openbsd/src
Files changed:
usr.sbin/npppd/l2tp/l2tp_subr.c
Commit message: Check if the avp->length is not broken.   Also make sure that
avp_enum() checks if avp->length is valid.

ok mvp


Vulnerable code:
/*	$OpenBSD: l2tp_subr.c,v 1.4 2012/05/08 13:15:11 yasuoka Exp $	*/
/* $Id: l2tp_subr.c,v 1.4 2012/05/08 13:15:11 yasuoka Exp $ */
	if (avp->length > pktlen)
	if (filldata != 0)
			if (avpsz < 6)
				return NULL;

Fixed code:
/*	$OpenBSD: l2tp_subr.c,v 1.5 2023/09/11 07:33:07 yasuoka Exp $	*/
/* $Id: l2tp_subr.c,v 1.5 2023/09/11 07:33:07 yasuoka Exp $ */
	if (avp->length < 6 || avp->length > pktlen)
	if (avp->length > 6 && filldata != 0)
		L2TP_SUBR_ASSERT(avpsz >= 6);
CVE-2023-52558 (C, published 2024-03-01T17:15Z)
Description: value: In OpenBSD 7.4 before errata 002 and OpenBSD 7.3 before errata 019, a network buffer that had to be split at certain length that could crash the kernel after receiving specially crafted escape sequences.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/openbsd/src
Files changed:
sys/kern/uipc_mbuf.c
Commit message: Avoid assertion failure when splitting mbuf cluster.

m_split() calls m_align() to initialize the data pointer of newly
allocated mbuf.  If the new mbuf will be converted to a cluster,
this is not necessary.  If additionally the new mbuf is larger than
MLEN, this can lead to a panic.
Only call m_align() when a valid m_data is needed.  This is the
case if we do not refecence the existing cluster, but memcpy() the
data into the new mbuf.

Reported-by: syzbot+0e6817f5877926f0e96a@syzkaller.appspotmail.com
OK claudio@ deraadt@


Vulnerable code:
/*	$OpenBSD: uipc_mbuf.c,v 1.287 2023/06/23 04:36:49 gnezdo Exp $	*/
		if (m->m_flags & M_EXT)
			goto extpacket;
		if (remain > MHLEN) {
		} else
			m_align(n, remain);
		m_align(n, remain);
extpacket:

Fixed code:
/*	$OpenBSD: uipc_mbuf.c,v 1.288 2023/10/20 16:25:15 bluhm Exp $	*/
		if ((m->m_flags & M_EXT) == 0 && remain > MHLEN) {
		}
		m_align(n, remain);
CVE-2021-21381 (C, published 2021-03-11T17:15Z)
Description: value: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be allowed by the app's permissions. By putting the special tokens `@@` and/or `@@u` in the Exec field of a Flatpak app's .desktop file, a malicious app publisher can trick flatpak into behaving as though the user had chosen to open a target file with their Flatpak app, which automatically makes that file available to the Flatpak app. This is fixed in version 1.10.2. A minimal solution is the first commit "`Disallow @@ and @@U usage in desktop files`". The follow-up commits "`dir: Reserve the whole @@ prefix`" and "`dir: Refuse to export .desktop files with suspicious uses of @@ tokens`" are recommended, but not strictly required. As a workaround, avoid installing Flatpak apps from untrusted sources, or check the contents of the exported `.desktop` files in `exports/share/applications/*.desktop` (typically `~/.local/share/flatpak/exports/share/applications/*.desktop` and `/var/lib/flatpak/exports/share/applications/*.desktop`) to make sure that literal filenames do not follow `@@` or `@@u`.
Severity: MEDIUM (CVSS v3 base score: 8.2)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/flatpak/flatpak
Files changed:
common/flatpak-dir.c
Commit message: dir: Refuse to export .desktop files with suspicious uses of @@ tokens

This is either a malicious/compromised app trying to do an attack, or
a mistake that will break handling of %f, %u and so on. Either way,
if we refuse to export the .desktop file, resulting in installation
failing, then it makes the rejection more obvious than quietly
removing the magic tokens.

Signed-off-by: Simon McVittie <smcv@collabora.com>
(cherry picked from commit 46b3ede5241561c7d588951048c687c5075a3eac)


Vulnerable code:
                g_print (_("Skipping invalid Exec argument %s\n"), arg);

Fixed code:
                {
                  flatpak_fail_error (error, FLATPAK_ERROR_EXPORT_FAILED,
                                     _("Invalid Exec argument %s"), arg);
                  goto out;
                }