hitoshura25/cvefixes huggingface dataset:
CVE-2024-23340 (TypeScript, published 2024-01-22T23:15Z)
Description: value: @hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with `url` behavior that is unexpected. In the standard API, if the URL contains `..`, here called "double dots", the URL string returned by Request will be in the resolved path. However, the `url` in @hono/node-server's Request as does not resolve double dots, so `http://localhost/static/.. /foo.txt` is returned. This causes vulnerabilities when using `serveStatic`. Modern web browsers and a latest `curl` command resolve double dots on the client side, so this issue doesn't affect those using either of those tools. However, problems may occur if accessed by a client that does not resolve them. Version 1.4.1 includes the change to fix this issue. As a workaround, don't use `serveStatic`.


Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/honojs/node-server
Files changed:
src/request.ts
test/assets/secret.txt
test/request.test.ts
test/serve-static.test.ts
Commit message: fix(request): handle "double dots" in URL (#124)



Vulnerable code:
    return `http://${this[incomingKey].headers.host}${this[incomingKey].url}`

Fixed code:
import { resolve } from 'node:path'
    let path = this[incomingKey]['path']
    if (!path) {
      const originalPath = this[incomingKey].url
      path = /\.\./.test(originalPath) ? resolve(originalPath) : originalPath
      this[incomingKey]['path'] = path
    }
    return `http://${this[incomingKey].headers.host}${path}`
secret

  it('Should resolve double dots in URL', async () => {
    const req = newRequest({
      headers: {
        host: 'localhost',
      },
      url: '/static/../foo.txt',
    } as IncomingMessage)
    expect(req).toBeInstanceOf(global.Request)
    expect(req.url).toBe('http://localhost/foo.txt')
    // Check if cached value is returned correctly
    expect(req.url).toBe('http://localhost/foo.txt')
  })

  it('Should handle double dots in URL', async () => {
    const res = await request(server).get('/static/../secret.txt')
    expect(res.status).toBe(404)
  })
CVE-2024-32652 (TypeScript, published 2024-04-19T19:15Z)
Description: value: The adapter @hono/node-server allows you to run your Hono application on Node.js. Prior to 1.10.1, the application hangs when receiving a Host header with a value that `@hono/node-server` can't handle well. Invalid values are those that cannot be parsed by the `URL` as a hostname such as an empty string, slashes `/`, and other strings. The version 1.10.1 includes the fix for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/honojs/node-server
Files changed:
src/listener.ts
test/listener.test.ts
Commit message: fix: catch ERR_INVALID_URL error in listener (#162)



Vulnerable code:
    // `fetchCallback()` requests a Request object, but global.Request is expensive to generate,
    // so generate a pseudo Request object with only the minimum required information.
    const req = newRequest(incoming)

    // Detect if request was aborted.
    outgoing.on('close', () => {
      if (incoming.destroyed) {
        req[getAbortController]().abort()
      }
    })


Fixed code:
      // `fetchCallback()` requests a Request object, but global.Request is expensive to generate,
      // so generate a pseudo Request object with only the minimum required information.
      const req = newRequest(incoming)

      // Detect if request was aborted.
      outgoing.on('close', () => {
        if (incoming.destroyed) {
          req[getAbortController]().abort()
        }
      })

describe('Invalid request', () => {
  const requestListener = getRequestListener(jest.fn())
  const server = createServer(async (req, res) => {
    await requestListener(req, res)

    if (!res.writableEnded) {
      res.writeHead(500, { 'Content-Type': 'text/plain' })
      res.end('error handler did not return a response')
    }
  })

  it('Should return server error for a request w/o host header', async () => {
    const res = await request(server).get('/').set('Host', '').send()
    expect(res.status).toBe(500)
  })

  it('Should return server error for a request invalid host header', async () => {
    const res = await request(server).get('/').set('Host', 'a b').send()
    expect(res.status).toBe(500)
  })
})
CVE-2021-3964 (PHP, published 2021-12-01T12:15Z)
Description: value: elgg is vulnerable to Authorization Bypass Through User-Controlled Key
Severity: MEDIUM (CVSS v3 base score: 5.9)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/elgg/elgg
Files changed:
mod/groups/actions/groups/membership/delete_invite.php
mod/groups/actions/groups/membership/delete_request.php
mod/groups/actions/groups/membership/join.php
mod/groups/actions/groups/membership/leave.php
Commit message: fix(groups): prevent misuse of group membership actions

Only allow actions to be executed for authorised requests.

Vulnerable code:
if (!$user && !($group instanceof \ElggGroup)) {
	return elgg_error_response();
if (!$user && !($group instanceof \ElggGroup)) {
	return elgg_error_response();
if (!$user || !($group instanceof \ElggGroup)) {
if (!$user || !($group instanceof \ElggGroup)) {

Fixed code:
if (!$user && !$group instanceof \ElggGroup) {
	return elgg_error_response(elgg_echo('error:missing_data'));
}

if (!$user->canEdit() && !$group->canEdit()) {
	return elgg_error_response(elgg_echo('actionunauthorized'));
if (!$user && !$group instanceof \ElggGroup) {
	return elgg_error_response(elgg_echo('error:missing_data'));
}

if (!$user->canEdit() && !$group->canEdit()) {
	return elgg_error_response(elgg_echo('actionunauthorized'));
if (!$user || !$group instanceof \ElggGroup) {
if (!$user->canEdit() && !$group->canEdit()) {
	return elgg_error_response(elgg_echo('actionunauthorized'));
}

if (!$user || !$group instanceof \ElggGroup) {
if (!$user->canEdit() && !$group->canEdit()) {
	return elgg_error_response(elgg_echo('actionunauthorized'));
}
CVE-2021-4072 (PHP, published 2021-12-24T14:15Z)
Description: value: elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/elgg/elgg
Files changed:
mod/reportedcontent/actions/reportedcontent/add.php
Commit message: fix(reported_content): sanitize report URLs



Vulnerable code:
$report->address = $address;

Fixed code:
$report->address = elgg_normalize_site_url($address);
CVE-2024-22194 (Unknown, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-215 \u2014 Insertion of Sensitive Information Into Debugging Code
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
Commit message: Merge branch 'release-0.12.1' into support-0.12.x


Vulnerable code:

Fixed code:
CVE-2024-22194 (Unknown, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-337 \u2014 Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
Commit message: Merge branch 'release-0.12.1' into support-0.12.x


Vulnerable code:

Fixed code:
CVE-2024-22194 (Unknown, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-215 \u2014 Insertion of Sensitive Information Into Debugging Code
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
Commit message: Merge branch 'release-0.13.1' into support-0.13.x


Vulnerable code:

Fixed code:
CVE-2024-22194 (Unknown, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-337 \u2014 Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
Commit message: Merge branch 'release-0.13.1' into support-0.13.x


Vulnerable code:

Fixed code:
CVE-2024-22194 (Unknown, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-215 \u2014 Insertion of Sensitive Information Into Debugging Code
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
Commit message: Merge branch 'release-0.10.1' into support-0.10.x


Vulnerable code:

Fixed code:
CVE-2024-22194 (Unknown, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-337 \u2014 Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
Commit message: Merge branch 'release-0.10.1' into support-0.10.x


Vulnerable code:

Fixed code:
CVE-2024-22194 (Other, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-215 \u2014 Insertion of Sensitive Information Into Debugging Code
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
setup.cfg
Commit message: Merge branches 'HotFix-0.9.1-refresh_pre_commit', 'HotFix-0.9.1-set_pandas_ceiling' and 'support-0.8.x' into release-0.9.1


Vulnerable code:
 -    pandas
-     rdflib >= 6.2.0

Fixed code:
 +    pandas < 2.1.0
+     rdflib >= 6.2.0, < 6.3.0
CVE-2024-22194 (Other, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-337 \u2014 Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
setup.cfg
Commit message: Merge branches 'HotFix-0.9.1-refresh_pre_commit', 'HotFix-0.9.1-set_pandas_ceiling' and 'support-0.8.x' into release-0.9.1


Vulnerable code:
 -    pandas
-     rdflib >= 6.2.0

Fixed code:
 +    pandas < 2.1.0
+     rdflib >= 6.2.0, < 6.3.0
CVE-2024-22194 (Unknown, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-215 \u2014 Insertion of Sensitive Information Into Debugging Code
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
Commit message: Merge pull request #145 from casework/release-0.14.1

Release 0.14.1

Vulnerable code:

Fixed code:
CVE-2024-22194 (Unknown, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-337 \u2014 Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
Commit message: Merge pull request #145 from casework/release-0.14.1

Release 0.14.1

Vulnerable code:

Fixed code:
CVE-2024-22194 (Unknown, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-215 \u2014 Insertion of Sensitive Information Into Debugging Code
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
Commit message: Merge pull request #146 from casework/release-0.5.1

Release 0.5.1

Vulnerable code:

Fixed code:
CVE-2024-22194 (Unknown, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-337 \u2014 Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
Commit message: Merge pull request #146 from casework/release-0.5.1

Release 0.5.1

Vulnerable code:

Fixed code:
CVE-2024-22194 (YAML, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-215 \u2014 Insertion of Sensitive Information Into Debugging Code
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
.github/workflows/cicd.yml
Commit message: Merge branches 'HotFix-0.8.1-refresh_pre_commit' and 'support-0.7.x' into release-0.8.1


Vulnerable code:
         python-version: 
           - '3.7'

Fixed code:
         python-version:
           - '3.8'
CVE-2024-22194 (YAML, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-337 \u2014 Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
.github/workflows/cicd.yml
Commit message: Merge branches 'HotFix-0.8.1-refresh_pre_commit' and 'support-0.7.x' into release-0.8.1


Vulnerable code:
         python-version: 
           - '3.7'

Fixed code:
         python-version:
           - '3.8'
CVE-2024-22194 (Python, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-215 \u2014 Insertion of Sensitive Information Into Debugging Code
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
case_utils/case_sparql_select/__init__.py
setup.cfg
Commit message: Merge branches 'HotFix-0.7.1-set_pyshacl_ceiling' and 'support-0.6.x' into release-0.7.1


Vulnerable code:
     for (row_no, row) in enumerate(graph.query(select_query_object)):
         for (column_no, column) in enumerate(row):
     rdflib >= 6.2.0

Fixed code:
     for row_no, row in enumerate(graph.query(select_query_object)):
         for column_no, column in enumerate(row):
+    rdflib >= 6.2.0, < 6.3.0