hitoshura25/cvefixes huggingface dataset:
CVE-2015-9097 (Ruby, published 2017-06-12T20:29Z)
Description: value: The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-93 \u2014 Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Repository: https://github.com/mikel/mail
Files changed:
lib/mail/field.rb
lib/mail/header.rb
lib/mail/patterns.rb
spec/mail/message_spec.rb
Commit message: Also unfold and split lazily

This has little effect on the specs, but on my header reading example it
makes about a 10x performance difference, finally bringing it within one
order of magnitude of the "fast hacky solution" at
https://gist.github.com/5901bbd810c08ed3d0b1


Vulnerable code:
        @name, @value = split(name)
      return self
      FIELD_NAME_MAP[@name.to_s.downcase] || @name
    # 2.2.3. Long Header Fields
    # 
    #  The process of moving from this folded multiple-line representation
    #  of a header field to its single line representation is called
    #  "unfolding". Unfolding is accomplished by simply removing any CRLF
    #  that is immediately followed by WSP.  Each header field should be
    #  treated in its unfolded form for further syntactic and semantic
    #  evaluation.
    def unfold(string)
      string.gsub(/#{CRLF}#{WSP}+/, ' ').gsub(/#{WSP}+/, ' ')
    end
    
    # Returns the header with all the folds removed
    def unfolded_header
      @unfolded_header ||= unfold(raw_source)
    end
    
      self.fields = unfolded_header.split(CRLF)
    FIELD_BODY    = /.+/
      Mail.read(fixture('emails', 'plain_emails', 'raw_email_incorrect_header.eml'))

Fixed code:
        @name = name[FIELD_PREFIX]
        @raw_value = name
      @name = FIELD_NAME_MAP[@name.to_s.downcase] || @name
      _, @value = split(@raw_value) if @raw_value && !@value
      @name
    # 2.2.3. Long Header Fields
    #
    #  The process of moving from this folded multiple-line representation
    #  of a header field to its single line representation is called
    #  "unfolding". Unfolding is accomplished by simply removing any CRLF
    #  that is immediately followed by WSP.  Each header field should be
    #  treated in its unfolded form for further syntactic and semantic
    #  evaluation.
    def unfold(string)
      string.gsub(/[\r\n \t]+/m, ' ')
    end

      value = unfold(value) if value.is_a?(String) || value.is_a?(Mail::Multibyte::Chars)

      self.fields = raw_source.split(HEADER_SPLIT)
    FIELD_PREFIX  = /\A(#{FIELD_NAME})/
    FIELD_BODY    = /.+/m
    HEADER_SPLIT  = /#{CRLF}(?!#{WSP})/
      Mail.read(fixture('emails', 'plain_emails', 'raw_email_incorrect_header.eml')).to_s
CVE-2015-9096 (Ruby, published 2017-06-12T20:29Z)
Description: value: Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command, as demonstrated by CRLF sequences immediately before and after a DATA substring.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-93 \u2014 Improper Neutralization of CRLF Sequences ('CRLF Injection')
The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Repository: https://github.com/ruby/ruby
Files changed:
ChangeLog
lib/net/smtp.rb
test/net/smtp/test_smtp.rb
Commit message: * lib/net/smtp.rb (getok, get_response): raise an ArgumentError when
CR or LF is included in a line, because they are not allowed in
RFC5321.

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55324 b2dd03c8-39d4-4d8f-98ff-823fe69b080e


Vulnerable code:

Fixed code:
Wed Jun  8 16:03:09 2016  Shugo Maeda  <shugo@ruby-lang.org>

	* lib/net/smtp.rb (getok, get_response): raise an ArgumentError when
	  CR or LF is included in a line, because they are not allowed in
	  RFC5321.

    def validate_line(line)
      # A bare CR or LF is not allowed in RFC5321.
      if /[\r\n]/ =~ line
        raise ArgumentError, "A line must not contain CR or LF"
      end
    end

      validate_line reqline
      validate_line reqline
      attr_reader :write_io


    def test_mailfrom
      sock = FakeSocket.new
      smtp = Net::SMTP.new 'localhost', 25
      smtp.instance_variable_set :@socket, sock
      assert smtp.mailfrom("foo@example.com").success?
      assert_equal "MAIL FROM:<foo@example.com>\r\n", sock.write_io.string
    end

    def test_rcptto
      sock = FakeSocket.new
      smtp = Net::SMTP.new 'localhost', 25
      smtp.instance_variable_set :@socket, sock
      assert smtp.rcptto("foo@example.com").success?
      assert_equal "RCPT TO:<foo@example.com>\r\n", sock.write_io.string
    end

    def test_auth_plain
      sock = FakeSocket.new
      smtp = Net::SMTP.new 'localhost', 25
      smtp.instance_variable_set :@socket, sock
      assert smtp.auth_plain("foo", "bar").success?
      assert_equal "AUTH PLAIN AGZvbwBiYXI=\r\n", sock.write_io.string
    end

    def test_crlf_injection
      smtp = Net::SMTP.new 'localhost', 25
      smtp.instance_variable_set :@socket, FakeSocket.new

      assert_raise(ArgumentError) do
        smtp.mailfrom("foo\r\nbar")
      end

      assert_raise(ArgumentError) do
        smtp.mailfrom("foo\rbar")
      end

      assert_raise(ArgumentError) do
        smtp.mailfrom("foo\nbar")
      end

      assert_raise(ArgumentError) do
        smtp.rcptto("foo\r\nbar")
      end
    end
CVE-2021-45470 (Unknown, published 2021-12-23T21:15Z)
Description: value: lib/DatabaseLayer.py in cve-search before 4.1.0 allows regular expression injection, which can lead to ReDoS (regular expression denial of service) or other impacts.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/cve-search/cve-search
Files changed:
Commit message: Merge pull request #629 from jorgectf/fix-regex-injection



Vulnerable code:

Fixed code:
CVE-2023-7101 (Perl, published 2023-12-24T22:15Z)
Description: value: Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. 

Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/jmcnamara/spreadsheet-parseexcel
Files changed:
lib/Spreadsheet/ParseExcel/Utility.pm
Commit message: Do not use string eval for conditional formatting


Vulnerable code:
    my $conditional;
    if ( $format_str =~ /^\[([<>=][^\]]+)\](.*)$/ ) {
        $conditional = $1;
        $format_str  = $2;
    if ($conditional) {

        # TODO. Replace string eval with a function.
        $section = eval "$number $conditional" ? 0 : 1;


Fixed code:
    my $conditional_op;
    my $conditional_value;
    if ( $format_str =~ /^\[([<>=]+)([^\]]+)\](.*)$/ ) {
        $conditional_op = $1;
        $conditional_value = $2;
        $format_str = $3;
    if ($conditional_op) {
        if ($conditional_op eq '>') {
            $section = $number > $conditional_value ? 0 : 1;
        } elsif ($conditional_op eq '>=') {
            $section = $number >= $conditional_value ? 0 : 1;
        } elsif ($conditional_op eq '<') {
            $section = $number < $conditional_value ? 0 : 1;
        } elsif ($conditional_op eq '<=') {
            $section = $number <= $conditional_value ? 0 : 1;
        } elsif ($conditional_op eq '=') {
            $section = $number == $conditional_value ? 0 : 1;
        } elsif ($conditional_op eq '==') {
            $section = $number == $conditional_value ? 0 : 1;
        } elsif ($conditional_op eq '<>') {
            $section = $number != $conditional_value ? 0 : 1;
        }
CVE-2021-25916 (JavaScript, published 2021-03-16T16:15Z)
Description: value: Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-1321 \u2014 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Repository: https://github.com/pjshumphreys/patchmerge
Files changed:
index.js
test2.js
Commit message: don't inadvertantly modify Object.prototype


Vulnerable code:

Fixed code:
      //Don't implicitly mutate Object.prototype but subsitute an empty object
      if(original[name] === Object.prototype) {
        delete original[name];

        Object.defineProperty(original, name, {
          enumerable: true,
          writable: true,
          value: {}
        });
      }

patchMerge = require('./index.js');
var obj = {}
console.log("Before : " + obj.isAdmin);
console.log(patchMerge(obj, JSON.parse('{ "__proto__": { "isAdmin": true }}')));
console.log("After : " + obj.isAdmin);
CVE-2020-11939 (C, published 2020-04-23T15:15Z)
Description: value: In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Due to the granular nature of the overflow primitive and the ability to control both the contents and layout of the nDPI library's heap memory through remote input, this vulnerability may be abused to achieve full Remote Code Execution against any network inspection stack that is linked against nDPI and uses it to perform network traffic analysis.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/ntop/nDPI
Files changed:
src/lib/protocols/ssh.c
Commit message: ssh: fixing unsigned overflow leading to heap overflow

cf GHSL-2020-051


Vulnerable code:
  u_int16_t offset = 22, buf_out_len = 0;
    offset += 4;

    offset += len;
  } else
    offset += 4 + len;
    offset += 4;

    offset += len;
  } else
    offset += 4 + len;
    offset += 4;

    offset += len;
  } else
    offset += 4 + len;
    offset += 4;

    offset += len;
  } else
    offset += 4 + len;
    offset += 4;

    offset += len;
  } else
    offset += 4 + len;
    offset += 4;

    offset += len;
  } else
    offset += 4 + len;

Fixed code:
  u_int32_t offset = 22, buf_out_len = 0;
  if (len > UINT32_MAX - 4 - offset)
    goto invalid_payload;
  offset += 4;
  }
  if (len > UINT32_MAX - offset)
    goto invalid_payload;
  offset += len;
  offset += 4;
  }
  if (len > UINT32_MAX - offset)
    goto invalid_payload;
  offset += len;
  offset += 4;
  }
  if (len > UINT32_MAX - offset)
    goto invalid_payload;
  offset += len;
  offset += 4;
  }
  if (len > UINT32_MAX - offset)
    goto invalid_payload;
  offset += len;
  offset += 4;
  }
  if (len > UINT32_MAX - offset)
    goto invalid_payload;
  offset += len;
  offset += 4;
  }
  if (len > UINT32_MAX - offset)
    goto invalid_payload;
  offset += len;
CVE-2020-11939 (C, published 2020-04-23T15:15Z)
Description: value: In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Due to the granular nature of the overflow primitive and the ability to control both the contents and layout of the nDPI library's heap memory through remote input, this vulnerability may be abused to achieve full Remote Code Execution against any network inspection stack that is linked against nDPI and uses it to perform network traffic analysis.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ntop/nDPI
Files changed:
src/lib/protocols/ssh.c
Commit message: ssh: fixing unsigned overflow leading to heap overflow

cf GHSL-2020-051


Vulnerable code:
  u_int16_t offset = 22, buf_out_len = 0;
    offset += 4;

    offset += len;
  } else
    offset += 4 + len;
    offset += 4;

    offset += len;
  } else
    offset += 4 + len;
    offset += 4;

    offset += len;
  } else
    offset += 4 + len;
    offset += 4;

    offset += len;
  } else
    offset += 4 + len;
    offset += 4;

    offset += len;
  } else
    offset += 4 + len;
    offset += 4;

    offset += len;
  } else
    offset += 4 + len;

Fixed code:
  u_int32_t offset = 22, buf_out_len = 0;
  if (len > UINT32_MAX - 4 - offset)
    goto invalid_payload;
  offset += 4;
  }
  if (len > UINT32_MAX - offset)
    goto invalid_payload;
  offset += len;
  offset += 4;
  }
  if (len > UINT32_MAX - offset)
    goto invalid_payload;
  offset += len;
  offset += 4;
  }
  if (len > UINT32_MAX - offset)
    goto invalid_payload;
  offset += len;
  offset += 4;
  }
  if (len > UINT32_MAX - offset)
    goto invalid_payload;
  offset += len;
  offset += 4;
  }
  if (len > UINT32_MAX - offset)
    goto invalid_payload;
  offset += len;
  offset += 4;
  }
  if (len > UINT32_MAX - offset)
    goto invalid_payload;
  offset += len;
CVE-2020-11940 (C, published 2020-04-23T15:15Z)
Description: value: In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH protocol messages on a network segment monitored by nDPI's library.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ntop/nDPI
Files changed:
src/lib/protocols/ssh.c
Commit message: ssh: adds systematic bounds checks in concat_hash_string

cf GHSL-2020-052


Vulnerable code:

Fixed code:
  if(offset+sizeof(u_int32_t) >= packet->payload_packet_len)
    goto invalid_payload;
  if(offset+sizeof(u_int32_t) >= packet->payload_packet_len)
    goto invalid_payload;
  if(offset+sizeof(u_int32_t) >= packet->payload_packet_len)
    goto invalid_payload;
  if(offset+sizeof(u_int32_t) >= packet->payload_packet_len)
    goto invalid_payload;
  if(offset+sizeof(u_int32_t) >= packet->payload_packet_len)
    goto invalid_payload;
  if(offset+sizeof(u_int32_t) >= packet->payload_packet_len)
    goto invalid_payload;
CVE-2020-15471 (C, published 2020-07-01T11:15Z)
Description: value: In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ntop/nDPI
Files changed:
src/lib/ndpi_main.c
Commit message: Added check for heap buffer overflow read


Vulnerable code:
	diff = ndpi_min(packet->payload_packet_len-a1, sizeof(flow->initial_binary_bytes));

Fixed code:

  
  
  
  
	diff = packet->payload_packet_len - a1;
	  diff = ndpi_min(diff, sizeof(flow->initial_binary_bytes));
CVE-2020-15473 (C, published 2020-07-01T11:15Z)
Description: value: In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ntop/nDPI
Files changed:
src/lib/protocols/openvpn.c
Commit message: Fix for potential heap-buffer-overflow in ndpi_search_openvpn


Vulnerable code:

  if(packet->payload_packet_len >= 40) {
      ovpn_payload += 2;
	     htons(packet->udp->source), htons(packet->udp->dest), packet->payload_packet_len);	   
	     ((packet->payload_packet_len == 112)
	     || ((packet->payload_packet_len == 80)
        alen = ovpn_payload[P_PACKET_ID_ARRAY_LEN_OFFSET(hmac_size)];
	  session_remote = ovpn_payload + P_PACKET_ID_ARRAY_LEN_OFFSET(hmac_size) + 1 + alen * 4;

          if(memcmp(flow->ovpn_session_id, session_remote, 8) == 0) {
	    NDPI_LOG_INFO(ndpi_struct,"found openvpn\n");
	    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OPENVPN, NDPI_PROTOCOL_UNKNOWN);
	    return;
	  } else {
            NDPI_LOG_DBG2(ndpi_struct,
		   "key mismatch: %02x%02x%02x%02x%02x%02x%02x%02x\n",
		   session_remote[0], session_remote[1], session_remote[2], session_remote[3],
		   session_remote[4], session_remote[5], session_remote[6], session_remote[7]);
            failed = 1;
          }
        } else

Fixed code:
  /* No u_ */int16_t ovpn_payload_len = packet->payload_packet_len;
  
  if(ovpn_payload_len >= 40) {
      ovpn_payload += 2, ovpn_payload_len -= 2;;
	     htons(packet->udp->source), htons(packet->udp->dest), ovpn_payload_len);	   
	     ((ovpn_payload_len == 112)
	     || ((ovpn_payload_len == 80)
	u_int16_t offset = P_PACKET_ID_ARRAY_LEN_OFFSET(hmac_size);
	  
        alen = ovpn_payload[offset];
	
	  offset += 1 + alen * 4;

	  if((offset+8) <= ovpn_payload_len) {
	    session_remote = &ovpn_payload[offset];
	    
	    if(memcmp(flow->ovpn_session_id, session_remote, 8) == 0) {
	      NDPI_LOG_INFO(ndpi_struct,"found openvpn\n");
	      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OPENVPN, NDPI_PROTOCOL_UNKNOWN);
	      return;
	    } else {
	      NDPI_LOG_DBG2(ndpi_struct,
			    "key mismatch: %02x%02x%02x%02x%02x%02x%02x%02x\n",
			    session_remote[0], session_remote[1], session_remote[2], session_remote[3],
			    session_remote[4], session_remote[5], session_remote[6], session_remote[7]);
	      failed = 1;
	    }
	  } else
	    failed = 1;
	} else
CVE-2020-15476 (C, published 2020-07-01T11:15Z)
Description: value: In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/ntop/nDPI
Files changed:
src/lib/protocols/oracle.c
Commit message: Adds bound check in oracle protocol

Found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21780


Vulnerable code:
	&&  (((packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00))

Fixed code:
	&&  (((packet->payload_packet_len >= 3 && packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00))
CVE-2021-3639 (C, published 2022-08-22T15:15Z)
Description: value: A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/latchset/mod_auth_mellon
Files changed:
auth_mellon_util.c
Commit message: Prevent redirect to URLs that begin with '///'

Visiting a logout URL like this:
    https://rp.example.co.jp/mellon/logout?ReturnTo=///fishing-site.example.com/logout.html
would have redirected the user to fishing-site.example.com

With the patch, this URL would be rejected.

Fixes: CVE-2021-3639


Vulnerable code:

Fixed code:
    if (url == NULL) {
        return HTTP_BAD_REQUEST;
    }

    if (strstr(url, "///") == url) {
        AM_LOG_RERROR(APLOG_MARK, APLOG_ERR, HTTP_BAD_REQUEST, r,
                          "URL starts with '///'");
        return HTTP_BAD_REQUEST;
    }
CVE-2021-21330 (Unknown, published 2021-02-26T03:15Z)
Description: value: aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In aiohttp before version 3.7.4 there is an open redirect vulnerability. A maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website. It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware. This security problem has been fixed in 3.7.4. Upgrade your dependency using pip as follows "pip install aiohttp >= 3.7.4". If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/aio-libs/aiohttp
Files changed:
Commit message: Merge branch 'ghsa-v6wp-4m6f-gcjg' into master

This patch fixes an open redirect vulnerability bug in
`aiohttp.web_middlewares.normalize_path_middleware` by
making sure that there's at most one slash at the
beginning of the `Location` header value.

Refs:
* https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
* https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg


Vulnerable code:

Fixed code: