hitoshura25/cvefixes huggingface dataset:
CVE-2015-5685 (C++, published 2015-08-13T14:59Z)
Description: value: The lazy_bdecode function in BitTorrent DHT bootstrap server (bootstrap-dht ) allows remote attackers to execute arbitrary code via a crafted packet, related to "improper indexing."
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/bittorrent/bootstrap-dht
Files changed:
lazy_bdecode.cpp
Commit message: Check for out-of-bounds bencoded lengths before advancing buffer pointer


Vulnerable code:
					if (start + len + 1 > end)
					if (start + len + 1 > end)

Fixed code:
					// remaining buffer size excluding ':'
					const ptrdiff_t buff_size = end - start - 1;
					if (len > buff_size)

					// remaining buffer size excluding ':'
					const ptrdiff_t buff_size = end - start - 1;
					if (len > buff_size)
					if (start == end) TORRENT_FAIL_BDECODE(bdecode_errors::unexpected_eof);
CVE-2021-43831 (Python, published 2021-12-15T20:15Z)
Description: value: Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users who receive a Gradio link can access any files on the host computer if they know the file names or file paths. This is limited only by the host operating system. Paths are opened in read only mode. The problem has been patched in gradio 2.5.0.
Severity: LOW (CVSS v3 base score: 7.7)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/gradio-app/gradio
Files changed:
gradio/networking.py
Commit message: secure path hotfix


Vulnerable code:
    path = secure_filename(path)
        with open(os.path.join(app.cwd, path), "rb") as encrypted_file:
        return send_file(os.path.join(app.cwd, path))

Fixed code:
        with open(safe_join(app.cwd, path), "rb") as encrypted_file:
        return send_file(safe_join(app.cwd, path))
CVE-2022-24770 (Unknown, published 2022-03-17T21:15Z)
Description: value: `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer. The problem has been patched as of `2.8.11`, which escapes the saved csv with single quotes. As a workaround, avoid opening csv files generated by `gradio` with Excel or similar spreadsheet programs.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-1236 \u2014 Improper Neutralization of Formula Elements in a CSV File
The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.
Repository: https://github.com/gradio-app/gradio
Files changed:
Commit message: Merge pull request #817 from gradio-app/csv-sec

Sanitize flagging inputs before writing to csv

Vulnerable code:

Fixed code:
CVE-2023-51449 (Python, published 2023-12-22T21:15Z)
Description: value: Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/gradio-app/gradio
Files changed:
.changeset/tough-zoos-move.md
gradio/utils.py
test/test_utils.py
Commit message: Prevent file traversals (#6833)

* prevent file traversal

* fix

* add changeset

* unit test

---------

Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>

Vulnerable code:
        if str(path_1.relative_to(path_2)).startswith(".."):  # prevent path traversal

Fixed code:
---
"gradio": minor
---

feat:Prevent file traversals
        if ".." in str(path_1.relative_to(path_2)):  # prevent path traversal
    assert not is_in_or_equal("/safe_dir/subdir/../../unsafe_file.txt", "/safe_dir/")
CVE-2023-51449 (Python, published 2023-12-22T21:15Z)
Description: value: Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/gradio-app/gradio
Files changed:
.changeset/rich-dragons-clap.md
gradio/routes.py
Commit message: Fix SSRF vulnerability on `/file=` route (#6794)

* ssrf

* add changeset

* awaits

* checkout

---------

Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>

Vulnerable code:
            if utils.validate_url(path_or_url):

Fixed code:
---
"gradio": minor
---

feat:Fix SSRF vulnerability on `/file=` route
            if client_utils.is_http_url_like(path_or_url):
CVE-2023-6572 (YAML, published 2023-12-14T14:15Z)
Description: value: Command Injection in GitHub repository gradio-app/gradio prior to main.
Severity: nan (CVSS v3 base score: 8.1)
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/gradio-app/gradio
Files changed:
.github/workflows/generate-changeset.yml
Commit message: remove echo (#6305)



Vulnerable code:
    - name: echo concurrency group
      run: echo ${{ github.event.workflow_run.head_repository.full_name }}::${{ github.event.workflow_run.head_branch }}

Fixed code:
CVE-2024-1729 (Python, published 2024-03-29T05:15Z)
Description: value: A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentials, which can be exploited to guess passwords based on response times. Successful exploitation of this vulnerability could allow an attacker to bypass authentication mechanisms and gain unauthorized access.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-367 \u2014 Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
Repository: https://github.com/gradio-app/gradio
Files changed:
.changeset/fine-pets-switch.md
gradio/route_utils.py
gradio/routes.py
test/test_routes.py
Commit message: Prevent timing attacks to guess Gradio passwords (#7440)

* secure timing

* add changeset

* format

* add changeset

---------

Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>

Vulnerable code:
    previous_root = config.get("root", None)
                and app.auth[username] == password
from gradio.route_utils import FnIndexInferError, get_root_url

Fixed code:
---
"gradio": patch
---

feat:Prevent timing attacks to guess Gradio passwords
import hmac
    previous_root = config.get("root")


def compare_passwords_securely(input_password: str, correct_password: str) -> bool:
    return hmac.compare_digest(input_password.encode(), correct_password.encode())
    compare_passwords_securely,
                and compare_passwords_securely(password, app.auth[username])  # type: ignore
from gradio.route_utils import (
    FnIndexInferError,
    compare_passwords_securely,
    get_root_url,
)


def test_compare_passwords_securely():
    password1 = "password"
    password2 = "pässword"
    assert compare_passwords_securely(password1, password1)
    assert not compare_passwords_securely(password1, password2)
    assert compare_passwords_securely(password2, password2)
CVE-2024-4253 (YAML, published 2024-06-04T08:15Z)
Description: value: A command injection vulnerability exists in the gradio-app/gradio repository, specifically within the 'test-functional.yml' workflow. The vulnerability arises due to improper neutralization of special elements used in a command, allowing for unauthorized modification of the base repository or secrets exfiltration. The issue affects versions up to and including '@gradio/video@0.6.12'. The flaw is present in the workflow's handling of GitHub context information, where it echoes the full name of the head repository, the head branch, and the workflow reference without adequate sanitization. This could potentially lead to the exfiltration of sensitive secrets such as 'GITHUB_TOKEN', 'COMMENT_TOKEN', and 'CHROMATIC_PROJECT_TOKEN'.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Repository: https://github.com/gradio-app/gradio
Files changed:
.github/workflows/test-functional.yml
Commit message: Update test-functional.yml - Fix vulnerability code injection (#8145)

* Update test-functional.yml

* Update test-functional.yml

* tweaks

---------

Co-authored-by: pngwn <hello@pngwn.io>

Vulnerable code:
      - name: echo github context
        if: always()
        run: echo "${{ github.event.workflow_run.head_repository.full_name }}-${{ github.event.workflow_run.head_branch }}-${{ github.workflow_ref }}"

Fixed code:
CVE-2023-25824 (C, published 2023-02-23T22:15Z)
Description: value: Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. Versions from 0.9.0 to 0.12.0 (including) did not properly fail blocking read operations on TLS connections when the transport hit timeouts. Instead it entered an endless loop retrying the read operation, consuming CPU resources. This could be exploited for denial of service attacks. If trace level logging was enabled, it would also produce an excessive amount of log output during the loop, consuming disk space. The problem has been fixed in commit d7eec4e598158ab6a98bf505354e84352f9715ec, please update to version 0.12.1. There are no workarounds, users who cannot update should apply the errno fix detailed in the security advisory. 

Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-835 \u2014 Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Repository: https://github.com/airtower-luna/mod_gnutls
Files changed:
src/gnutls_io.c
Commit message: Fix loop in blocking read on transport timeout

The loop was cased by an incorrect errno if the transport read in
mgs_transport_read() fails with an APR TIMEUP status, as happens when
mod_reqtimeout limits are exceeded. Setting the transport errno to
EGAIN meant that a blocking read would be retried endlessly, setting
ETIMEDOUT instead makes the read fail as it should.

The bug was introduced in commit 92cb0cca41af946055307e373b6ab6d76d34f356,
first release to include it was 0.9.0.

Many thanks to Félix Arreola Rodríguez for the detailed analysis [1]
on the Debian bug tracker!

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=942737#25


Vulnerable code:
 *  Copyright 2015-2020 Fiona Klute
            gnutls_transport_set_errno(ctxt->session, EAGAIN);

Fixed code:
 *  Copyright 2015-2022 Fiona Klute
            } else if (rc == GNUTLS_E_PULL_ERROR
                       && APR_STATUS_IS_TIMEUP(ctxt->input_rc)) {
                ap_log_cerror(
                    APLOG_MARK, APLOG_TRACE2, ctxt->input_rc, ctxt->c,
                    "%s: transport read timed out", __func__);
            gnutls_transport_set_errno(ctxt->session, ETIMEDOUT);
CVE-2018-1000201 (Ruby, published 2018-06-22T18:29Z)
Description: value: ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-426 \u2014 Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Repository: https://github.com/ffi/ffi
Files changed:
lib/ffi/library.rb
Commit message: Don't treat Symbol args different to Strings in ffi_lib

Symbols were sent directly to FFI::DynamicLibrary.open in the first
attempt, resulting in a TypeError, so that only the mangled library
name was actually loaded.

This moves conversion to String to the front, so that subsequent
calls can assume Strings only.


Vulnerable code:
    lib = lib.to_s unless lib.kind_of?(String)
          libnames = (name.is_a?(::Array) ? name : [ name ]).map { |n| [ n, FFI.map_library_name(n) ].uniq }.flatten.compact
                libname = libname.to_s

Fixed code:
          libnames = (name.is_a?(::Array) ? name : [ name ]).map(&:to_s).map { |n| [ n, FFI.map_library_name(n) ].uniq }.flatten.compact
CVE-2018-1000201 (Ruby, published 2018-06-22T18:29Z)
Description: value: ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
Severity: MEDIUM (CVSS v3 base score: 7.8)
Weakness: CWE-426 \u2014 Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Repository: https://github.com/ffi/ffi
Files changed:
lib/ffi/library.rb
Commit message: Don't search in hardcoded paths on Windows

Native Windows apps don't use "/usr" path to store system dlls.
It's even more harm than good to search through these directories,
since they are used in Cygwin and it can lead to accidentaly loading
Cygwin DLLs into native Windows apps.

Hardcoded paths are disabled for MINGW and MSWIN environments only.
They are still present on Cygwin and MSYS2, because these POSIX-API
based environments don't use LoadLibrary() but dl_open() to load DLLs.


Vulnerable code:
                unless libname.start_with?("/")

Fixed code:
                unless libname.start_with?("/") || FFI::Platform.windows?
CVE-2021-44108 (C, published 2022-04-05T02:15Z)
Description: value: A null pointer dereference in src/amf/namf-handler.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request to amf.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/open5gs/open5gs
Files changed:
lib/sbi/message.c
src/amf/namf-handler.c
Commit message: [AMF] fix the memory problem (#1247)

1. memory corruption
- Overflow num_of_part in SBI message
2. null pointer dereference
- n2InfoContent->ngap_ie_type


Vulnerable code:
        ogs_error("JSON parse error");
    if (at && length) {
            if (data->part[data->num_of_part].content_type)
                ogs_free(data->part[data->num_of_part].content_type);
            if (data->part[data->num_of_part].content_id)
                ogs_free(data->part[data->num_of_part].content_id);
    if (at && length) {
            ogs_log_hexdump(OGS_LOG_FATAL, (unsigned char *)at, length);
    data->num_of_part++;
    if (data.part[i].content_id)
        ogs_free(data.part[i].content_id);
    if (data.part[i].content_type)
        ogs_free(data.part[i].content_type);

    switch (n2InfoContent->ngap_ie_type) {
        ogs_error("Not implemented ngap_ie_type[%d]",
                n2InfoContent->ngap_ie_type);

Fixed code:
        ogs_error("JSON parse error [%s]", json);
    if (data->num_of_part < OGS_SBI_MAX_NUM_OF_PART && at && length) {
            ogs_assert(data->part[data->num_of_part].content_type == NULL);
            ogs_assert(data->part[data->num_of_part].content_id == NULL);
    if (data->num_of_part < OGS_SBI_MAX_NUM_OF_PART && at && length) {
            ogs_log_hexdump(OGS_LOG_ERROR, (unsigned char *)at, length);
    if (data->num_of_part < OGS_SBI_MAX_NUM_OF_PART) {
        data->num_of_part++;
    }
    if (data.num_of_part > OGS_SBI_MAX_NUM_OF_PART) {
        /* Overflow Issues #1247 */
        ogs_fatal("Overflow num_of_part[%d]", data.num_of_part);
        ogs_assert_if_reached();
    }

            if (data.part[i].content_id)
                ogs_free(data.part[i].content_id);
            if (data.part[i].content_type)
                ogs_free(data.part[i].content_type);
    OpenAPI_ngap_ie_type_e ngapIeType = OpenAPI_ngap_ie_type_NULL;


        ngapIeType = n2InfoContent->ngap_ie_type;

    switch (ngapIeType) {
        ogs_error("Not implemented ngapIeType[%d]", ngapIeType);
CVE-2021-44109 (C, published 2022-04-05T02:15Z)
Description: value: A buffer overflow in lib/sbi/message.c in Open5GS 2.3.6 and earlier allows remote attackers to Denial of Service via a crafted sbi request.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/open5gs/open5gs
Files changed:
lib/sbi/message.c
src/amf/namf-handler.c
Commit message: [AMF] fix the memory problem (#1247)

1. memory corruption
- Overflow num_of_part in SBI message
2. null pointer dereference
- n2InfoContent->ngap_ie_type


Vulnerable code:
        ogs_error("JSON parse error");
    if (at && length) {
            if (data->part[data->num_of_part].content_type)
                ogs_free(data->part[data->num_of_part].content_type);
            if (data->part[data->num_of_part].content_id)
                ogs_free(data->part[data->num_of_part].content_id);
    if (at && length) {
            ogs_log_hexdump(OGS_LOG_FATAL, (unsigned char *)at, length);
    data->num_of_part++;
    if (data.part[i].content_id)
        ogs_free(data.part[i].content_id);
    if (data.part[i].content_type)
        ogs_free(data.part[i].content_type);

    switch (n2InfoContent->ngap_ie_type) {
        ogs_error("Not implemented ngap_ie_type[%d]",
                n2InfoContent->ngap_ie_type);

Fixed code:
        ogs_error("JSON parse error [%s]", json);
    if (data->num_of_part < OGS_SBI_MAX_NUM_OF_PART && at && length) {
            ogs_assert(data->part[data->num_of_part].content_type == NULL);
            ogs_assert(data->part[data->num_of_part].content_id == NULL);
    if (data->num_of_part < OGS_SBI_MAX_NUM_OF_PART && at && length) {
            ogs_log_hexdump(OGS_LOG_ERROR, (unsigned char *)at, length);
    if (data->num_of_part < OGS_SBI_MAX_NUM_OF_PART) {
        data->num_of_part++;
    }
    if (data.num_of_part > OGS_SBI_MAX_NUM_OF_PART) {
        /* Overflow Issues #1247 */
        ogs_fatal("Overflow num_of_part[%d]", data.num_of_part);
        ogs_assert_if_reached();
    }

            if (data.part[i].content_id)
                ogs_free(data.part[i].content_id);
            if (data.part[i].content_type)
                ogs_free(data.part[i].content_type);
    OpenAPI_ngap_ie_type_e ngapIeType = OpenAPI_ngap_ie_type_NULL;


        ngapIeType = n2InfoContent->ngap_ie_type;

    switch (ngapIeType) {
        ogs_error("Not implemented ngapIeType[%d]", ngapIeType);
CVE-2021-45462 (C, published 2021-12-23T04:15Z)
Description: value: In Open5GS 2.4.0, a crafted packet from UE can crash SGW-U/UPF.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1284 \u2014 Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Repository: https://github.com/open5gs/open5gs
Files changed:
src/sgwu/gtp-path.c
src/smf/gtp-path.c
src/upf/gtp-path.c
Commit message: A crafted packet from UE can crash SGW-U/UPF


Vulnerable code:

Fixed code:
    if (gtp_h->type != OGS_GTPU_MSGTYPE_END_MARKER &&
        pkbuf->len <= len) {
        ogs_error("[DROP] Small GTPU packet(type:%d len:%d)", gtp_h->type, len);
        ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len);
        goto cleanup;
    }
    if (gtp_h->type != OGS_GTPU_MSGTYPE_END_MARKER &&
        pkbuf->len <= len) {
        ogs_error("[DROP] Small GTPU packet(type:%d len:%d)", gtp_h->type, len);
        ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len);
        goto cleanup;
    }
    if (gtp_h->type != OGS_GTPU_MSGTYPE_END_MARKER &&
        pkbuf->len <= len) {
        ogs_error("[DROP] Small GTPU packet(type:%d len:%d)", gtp_h->type, len);
        ogs_log_hexdump(OGS_LOG_ERROR, pkbuf->data, pkbuf->len);
        goto cleanup;
    }