hitoshura25/cvefixes huggingface dataset:
CVE-2023-44488 (C, published 2023-09-30T20:15Z)
Description: value: VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-755 \u2014 Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
Repository: https://github.com/webmproject/libvpx
Files changed:
test/resize_test.cc
vp9/common/vp9_alloccommon.c
vp9/encoder/vp9_encoder.c
Commit message: Fix bug with smaller width bigger size

Fixed previous patch that clusterfuzz failed on.

Bug: webm:1642
Change-Id: If0e08e72abd2e042efe4dcfac21e4cc51afdfdb9


Vulnerable code:
    if (frame < 100) {
      *w = initial_w * 7 / 10;
      *h = initial_h * 16 / 10;
      return;
    }
// TODO(https://crbug.com/webm/1642): This causes a segfault in
// init_encode_frame_mb_context().
TEST_P(ResizeRealtimeTest, DISABLED_TestExternalResizeSmallerWidthBiggerSize) {

  if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) {
    // Create the segmentation map structure and set to 0.
    free_seg_map(cm);
    if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols)) goto fail;
  }

    memset(cpi->consec_zero_mv, 0,
           cm->mi_rows * cm->mi_cols * sizeof(*cpi->consec_zero_mv));

Fixed code:
    *w = initial_w * 7 / 10;
    *h = initial_h * 16 / 10;
TEST_P(ResizeRealtimeTest, TestExternalResizeSmallerWidthBiggerSize) {
  if (cm->seg_map_alloc_size < cm->mi_rows * cm->mi_cols) {
    // Create the segmentation map structure and set to 0.
    free_seg_map(cm);
    if (alloc_seg_map(cm, cm->mi_rows * cm->mi_cols)) goto fail;
  }

static void free_copy_partition_data(VP9_COMP *cpi) {
  vpx_free(cpi->prev_partition);
  cpi->prev_partition = NULL;
  vpx_free(cpi->prev_segment_id);
  cpi->prev_segment_id = NULL;
  vpx_free(cpi->prev_variance_low);
  cpi->prev_variance_low = NULL;
  vpx_free(cpi->copied_frame_cnt);
  cpi->copied_frame_cnt = NULL;
}

      vp9_free_pc_tree(&cpi->td);
      vpx_free(cpi->mbmi_ext_base);
    vpx_free(cpi->consec_zero_mv);
    CHECK_MEM_ERROR(
        &cm->error, cpi->consec_zero_mv,
        vpx_calloc(cm->mi_rows * cm->mi_cols, sizeof(*cpi->consec_zero_mv)));

    vpx_free(cpi->skin_map);
    CHECK_MEM_ERROR(
        &cm->error, cpi->skin_map,
        vpx_calloc(cm->mi_rows * cm->mi_cols, sizeof(cpi->skin_map[0])));

    free_copy_partition_data(cpi);
    alloc_copy_partition_data(cpi);
CVE-2023-5217 (C++, published 2023-09-28T16:15Z)
Description: value: Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/webmproject/libvpx
Files changed:
test/encode_api_test.cc
Commit message: encode_api_test: add ConfigResizeChangeThreadCount

Update thread counts and resolution to ensure allocations are updated
correctly. VP8 is disabled to avoid a crash.

Bug: chromium:1486441
Change-Id: Ie89776d9818d27dc351eff298a44c699e850761b


Vulnerable code:
  ASSERT_EQ(vpx_codec_enc_config_default(&iface, cfg, 0), VPX_CODEC_OK);

Fixed code:
      ASSERT_EQ(vpx_codec_enc_config_default(iface, &cfg, 0), VPX_CODEC_OK);
TEST(EncodeAPI, ConfigResizeChangeThreadCount) {
  constexpr int kInitWidth = 1024;
  constexpr int kInitHeight = 1024;

  for (const auto *iface : kCodecIfaces) {
    SCOPED_TRACE(vpx_codec_iface_name(iface));
    if (!IsVP9(iface)) {
      GTEST_SKIP() << "TODO(https://crbug.com/1486441) remove this condition "
                      "after VP8 is fixed.";
    }
    for (int i = 0; i < (IsVP9(iface) ? 2 : 1); ++i) {
      vpx_codec_enc_cfg_t cfg = {};
      struct Encoder {
        ~Encoder() { EXPECT_EQ(vpx_codec_destroy(&ctx), VPX_CODEC_OK); }
        vpx_codec_ctx_t ctx = {};
      } enc;

      ASSERT_EQ(vpx_codec_enc_config_default(iface, &cfg, 0), VPX_CODEC_OK);
      // Start in threaded mode to ensure resolution and thread related
      // allocations are updated correctly across changes in resolution and
      // thread counts. See https://crbug.com/1486441.
      cfg.g_threads = 4;
      EXPECT_NO_FATAL_FAILURE(
          InitCodec(*iface, kInitWidth, kInitHeight, &enc.ctx, &cfg));
      if (IsVP9(iface)) {
        EXPECT_EQ(vpx_codec_control_(&enc.ctx, VP9E_SET_TILE_COLUMNS, 6),
                  VPX_CODEC_OK);
        EXPECT_EQ(vpx_codec_control_(&enc.ctx, VP9E_SET_ROW_MT, i),
                  VPX_CODEC_OK);
      }

      cfg.g_w = 1000;
      cfg.g_h = 608;
      EXPECT_EQ(vpx_codec_enc_config_set(&enc.ctx, &cfg), VPX_CODEC_OK)
          << vpx_codec_error_detail(&enc.ctx);

      cfg.g_w = 16;
      cfg.g_h = 720;

      for (const auto threads : { 1, 4, 8, 6, 2, 1 }) {
        cfg.g_threads = threads;
        EXPECT_NO_FATAL_FAILURE(EncodeWithConfig(cfg, &enc.ctx))
            << "iteration: " << i << " threads: " << threads;
      }
    }
  }
}
CVE-2023-5217 (C++, published 2023-09-28T16:15Z)
Description: value: Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/webmproject/libvpx
Files changed:
test/encode_api_test.cc
vp8/encoder/onyx_if.c
Commit message: VP8: disallow thread count changes

Currently allocations are done at encoder creation time. Going from
threaded to non-threaded would cause a crash.

Bug: chromium:1486441
Change-Id: Ie301c2a70847dff2f0daae408fbef1e4d42e73d4


Vulnerable code:
    if (!IsVP9(iface)) {
      GTEST_SKIP() << "TODO(https://crbug.com/1486441) remove this condition "
                      "after VP8 is fixed.";
    }

Fixed code:
  if (cpi->initial_width) {
    // TODO(https://crbug.com/1486441): Allow changing thread counts; the
    // allocation is done once in vp8_create_compressor().
    oxcf->multi_threaded = cpi->oxcf.multi_threaded;
  }
CVE-2016-7144 (C, published 2017-01-18T17:59Z)
Description: value: The m_authenticate function in modules/m_sasl.c in UnrealIRCd before 3.2.10.7 and 4.x before 4.0.6 allows remote attackers to spoof certificate fingerprints and consequently log in as another user via a crafted AUTHENTICATE parameter.
Severity: MEDIUM (CVSS v3 base score: 8.1)
Weakness: CWE-287 \u2014 Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Repository: https://github.com/unrealircd/unrealircd
Files changed:
src/modules/m_sasl.c
Commit message: Fix AUTHENTICATE bug


Vulnerable code:

Fixed code:
	if ((parv[1][0] == ':') || strchr(parv[1], ' '))
	{
		sendto_one(sptr, err_str(ERR_CANNOTDOCOMMAND), me.name, "*", "AUTHENTICATE", "Invalid parameter");
		return 0;
	}
CVE-2018-10916 (C++, published 2018-08-01T14:29Z)
Description: value: It has been discovered that lftp up to and including version 4.8.3 does not properly sanitize remote file names, leading to a loss of integrity on the local system when reverse mirroring is used. A remote attacker may trick a user to use reverse mirroring on an attacker controlled FTP server, resulting in the removal of all files in the current working directory of the victim's system.
Severity: HIGH (CVSS v3 base score: 6.5)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/lavv17/lftp
Files changed:
src/MirrorJob.cc
Commit message: mirror: prepend ./ to rm and chmod arguments to avoid URL recognition (fix #452)


Vulnerable code:
	    ArgV args("rm");
	    if(file->TypeIs(file->DIRECTORY))
	    {
	       if(recursion_mode==RECURSION_NEVER)
		  args.setarg(0,"rmdir");
	       else
		  args.Append("-r");
	    }
	    ArgV *args=new ArgV("rm");
	    args->Append(file->name);
	       {
		  args->setarg(0,"rmdir");
	       }
	    a->Append(file->name);
	    args->Append(file->name);

Fixed code:
	 bool use_rmdir = (file->TypeIs(file->DIRECTORY)
			   && recursion_mode==RECURSION_NEVER);
	    ArgV args(use_rmdir?"rmdir":"rm");
	    if(file->TypeIs(file->DIRECTORY) && !use_rmdir)
	       args.Append("-r");
	    ArgV *args=new ArgV(use_rmdir?"rmdir":"rm");
	    args->Append(dir_file(".",file->name));
	    a->Append(dir_file(".",file->name));
	    args->Append(dir_file(".",file->name));
CVE-2014-125076 (PHP, published 2023-01-11T19:15Z)
Description: value: A vulnerability was found in NoxxieNl Criminals. It has been classified as critical. Affected is an unknown function of the file ingame/roulette.php. The manipulation of the argument gambleMoney leads to sql injection. The patch is identified as 0a60b31271d4cbf8babe4be993d2a3a1617f0897. It is recommended to apply a patch to fix this issue. VDB-218022 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/NoxxieNl/Criminals
Files changed:
ingame/roulette.php
Commit message: SQL Injection fix

Vulnerable code:
            $dbCon->query('UPDATE users SET cash = (cash + "' . (int) ($_POST['gambleMoney'] * 36) . '") WHERE id = "' . $userData['id'] . '"');
            $dbCon->query('UPDATE users SET cash = (cash - "' . $_POST['gambleMoney'] . '") WHERE id = "' . $userData['id'] . '"');

Fixed code:
            $dbCon->query('UPDATE users SET cash = (cash + "' . (int) (addslashes($_POST['gambleMoney']) * 36) . '") WHERE id = "' . $userData['id'] . '"');
            $dbCon->query('UPDATE users SET cash = (cash - "' . (int) addslashes($_POST['gambleMoney']) . '") WHERE id = "' . $userData['id'] . '"');
CVE-2021-47621 (Java, published 2024-06-21T06:15Z)
Description: value: ClassGraph before 4.8.112 was not resistant to XML eXternal Entity (XXE) attacks.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/classgraph/classgraph
Files changed:
src/main/java/nonapi/io/github/classgraph/utils/VersionFinder.java
Commit message: Adding SecureDocumentBuilderFactory & SecureXPATHFactory to prevent XXE( XML External Entity) attack


Vulnerable code:
                        final Document doc = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(is);
                        String version = (String) XPathFactory.newInstance().newXPath().compile("/project/version")

Fixed code:
import javax.xml.XMLConstants;
import javax.xml.parsers.ParserConfigurationException;
import javax.xml.xpath.XPathFactoryConfigurationException;
                        final Document doc = getSecureDocumentBuilderFactory().newDocumentBuilder().parse(is);
                        String version = (String) getSecureXPathFactory().newXPath().compile("/project/version")

    /**
     * Helper method to provide a XXE secured DocumentBuilder Factory.
     *
     * reference - https://gist.github.com/AlainODea/1779a7c6a26a5c135280bc9b3b71868f
     * reference - https://rules.sonarsource.com/java/tag/owasp/RSPEC-2755
     * @return DocumentBuilderFactory
     * @throws ParserConfigurationException
     */
    private static DocumentBuilderFactory getSecureDocumentBuilderFactory() throws ParserConfigurationException {
        DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
        dbf.setXIncludeAware(false);
        dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        dbf.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
        dbf.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
        dbf.setExpandEntityReferences(false);
        dbf.setNamespaceAware(true);
        dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
        dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
        dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
        dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
        return dbf;
    }

    /**
     * Helper method to provide a XXE secured XPathFactory Factory.
     *
     * reference - reference - https://rules.sonarsource.com/java/tag/owasp/RSPEC-2755
     * @return XPathFactory
     * @throws XPathFactoryConfigurationException
     */
    private static XPathFactory getSecureXPathFactory() throws XPathFactoryConfigurationException {
        XPathFactory xPathFactory = XPathFactory.newInstance();
        xPathFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
        return xPathFactory;
    }
CVE-2020-28032 (PHP, published 2020-11-02T21:15Z)
Description: value: WordPress before 5.5.2 mishandles deserialization requests in wp-includes/Requests/Utility/FilteredIterator.php.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/WordPress/wordpress-develop
Files changed:
src/wp-includes/Requests/Utility/FilteredIterator.php
tests/phpunit/tests/functions.php
Commit message: External Libraries: Disable deserialization in Requests_Utility_FilteredIterator

Props xknown, peterwilsoncc, desrosj, dd32, whyisjake.
Merges [49373] to trunk.

git-svn-id: https://develop.svn.wordpress.org/trunk@49382 602fd350-edb4-49c9-b593-d223f7449a82


Vulnerable code:

Fixed code:

	/**
	 * @inheritdoc
	 */
	public function unserialize( $serialized ) {
	}

	/**
	 * @inheritdoc
	 */
	public function __unserialize( $serialized ) { // phpcs:ignore PHPCompatibility.FunctionNameRestrictions.ReservedFunctionNames.MethodDoubleUnderscore,PHPCompatibility.FunctionNameRestrictions.NewMagicMethods.__unserializeFound
	}

	public function __wakeup() { // phpcs:ignore PHPCompatibility.FunctionNameRestrictions.ReservedFunctionNames.MethodDoubleUnderscore,PHPCompatibility.FunctionNameRestrictions.NewMagicMethods.__wakeupFound
		unset( $this->callback );
	}
	/**
	 * @dataProvider data_serialize_deserialize_objects
	 */
	function test_deserialize_request_utility_filtered_iterator_objects( $value ) {
		$serialized = maybe_serialize( $value );
		if ( get_class( $value ) === 'Requests_Utility_FilteredIterator' ) {
			$new_value = unserialize( $serialized );
			if ( version_compare( PHP_VERSION, '5.3', '>=' ) ) {
				$property = ( new ReflectionClass( 'Requests_Utility_FilteredIterator' ) )->getProperty( 'callback' );
				$property->setAccessible( true );
				$callback_value = $property->getValue( $new_value );
				$this->assertSame( null, $callback_value );
			} else {
				$current_item = @$new_value->current(); // phpcs:ignore WordPress.PHP.NoSilencedErrors.Discouraged
				$this->assertSame( null, $current_item );
			}
		} else {
			$this->assertEquals( $value->count(), unserialize( $serialized )->count() );
		}
	}

	function data_serialize_deserialize_objects() {
		return array(
			array( new Requests_Utility_FilteredIterator( array( 1 ), 'md5' ) ),
			array( new Requests_Utility_FilteredIterator( array( 1, 2 ), 'sha1' ) ),
			array( new ArrayIterator( array( 1, 2, 3 ) ) ),
		);
	}
CVE-2020-28037 (PHP, published 2020-11-02T21:15Z)
Description: value: is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed, which might allow an attacker to perform a new installation, leading to remote code execution (as well as a denial of service for the old installation).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-754 \u2014 Improper Check for Unusual or Exceptional Conditions
The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Repository: https://github.com/WordPress/wordpress-develop
Files changed:
src/wp-includes/functions.php
Commit message: Upgrade/install: Improve logic check when determining installation status.

Improve handling of ambiguous return values to determine if a blog is installed.

Props zieladam, xknown.
Merges [49377] to trunk.

git-svn-id: https://develop.svn.wordpress.org/trunk@49386 602fd350-edb4-49c9-b593-d223f7449a82


Vulnerable code:
		if ( ! $wpdb->get_results( "DESCRIBE $table;" ) ) {

Fixed code:
		$described_table = $wpdb->get_results( "DESCRIBE $table;" );
		if ( is_array( $described_table ) && count( $described_table ) === 0 ) {
CVE-2020-28039 (PHP, published 2020-11-02T21:15Z)
Description: value: is_protected_meta in wp-includes/meta.php in WordPress before 5.5.2 allows arbitrary file deletion because it does not properly determine whether a meta key is considered protected.
Severity: MEDIUM (CVSS v3 base score: 9.1)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/WordPress/wordpress-develop
Files changed:
src/wp-includes/meta.php
tests/phpunit/tests/meta/isProtectedMeta.php
Commit message: Meta: Sanitize meta key before checking protection status.

Props zieladam, peterwilsoncc, xknown, whyisjake.
Merges [49377,49381] to trunk.

git-svn-id: https://develop.svn.wordpress.org/trunk@49387 602fd350-edb4-49c9-b593-d223f7449a82


Vulnerable code:
	$protected = ( '_' === $meta_key[0] );

Fixed code:
	$sanitized_key = preg_replace( "/[^\x20-\x7E\p{L}]/", '', $meta_key );
	$protected     = strlen( $sanitized_key ) > 0 && ( '_' === $sanitized_key[0] );
<?php

/**
 * @group meta
 * @covers ::is_protected_meta
 */
class Tests_Meta_isProtectedMeta extends WP_UnitTestCase {

	/**
	 * @dataProvider protected_data
	 */
	public function test_protected( $key ) {
		$this->assertTrue( is_protected_meta( $key ) );
	}

	public function protected_data() {
		$protected_keys = array(
			array( '_wp_attachment' ),
		);
		for ( $i = 0, $max = 31; $i < $max; $i ++ ) {
			$protected_keys[] = array( chr( $i ) . '_wp_attachment' );
		}
		for ( $i = 127, $max = 159; $i <= $max; $i ++ ) {
			$protected_keys[] = array( chr( $i ) . '_wp_attachment' );
		}
		$protected_keys[] = array( chr( 95 ) . '_wp_attachment' );

		return $protected_keys;
	}

	/**
	 * @dataProvider unprotected_data
	 */
	public function test_unprotected( $key ) {
		$this->assertFalse( is_protected_meta( $key ) );
	}

	public function unprotected_data() {
		$unprotected_keys = array(
			array( 'singleword' ),
			array( 'two_words' ),
			array( 'ąŌ_not_so_protected_meta' ),
		);

		for ( $i = 32, $max = 94; $i <= $max; $i ++ ) {
			$unprotected_keys[] = array( chr( $i ) . '_wp_attachment' );
		}
		for ( $i = 96, $max = 126; $i <= $max; $i ++ ) {
			$unprotected_keys[] = array( chr( $i ) . '_wp_attachment' );
		}

		return $unprotected_keys;
	}

}
CVE-2022-0235 (JSON, published 2022-01-16T17:15Z)
Description: value: node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/node-fetch/node-fetch
Files changed:
docs/CHANGELOG.md
package.json
Commit message: 3.1.1 release (#1451)



Vulnerable code:
## Unreleased
* fix(request): fix crash when an invalid redirection URL is encountered https://github.com/node-fetch/node-fetch/pull/1387
* fix: handle errors from the request body stream by @mdmitry01 in https://github.com/node-fetch/node-fetch/pull/1392
  "version": "3.1.0",

Fixed code:
## What's Changed
* core: update fetch-blob by @jimmywarting in https://github.com/node-fetch/node-fetch/pull/1371
* docs: Fix typo around sending a file by @jimmywarting in https://github.com/node-fetch/node-fetch/pull/1381
* core: (http.request): Cast URL to string before sending it to NodeJS core by @jimmywarting in https://github.com/node-fetch/node-fetch/pull/1378
* core: handle errors from the request body stream by @mdmitry01 in https://github.com/node-fetch/node-fetch/pull/1392
* core: Better handle wrong redirect header in a response by @tasinet in https://github.com/node-fetch/node-fetch/pull/1387
* core: Don't use buffer to make a blob by @jimmywarting in https://github.com/node-fetch/node-fetch/pull/1402
* docs: update readme for TS @types/node-fetch by @adamellsworth in https://github.com/node-fetch/node-fetch/pull/1405
* core: Fix logical operator priority to disallow GET/HEAD with non-empty body by @maxshirshin in https://github.com/node-fetch/node-fetch/pull/1369
* core: Don't use global buffer by @jimmywarting in https://github.com/node-fetch/node-fetch/pull/1422
* ci: fix main branch by @dnalborczyk in https://github.com/node-fetch/node-fetch/pull/1429
* core: use more node: protocol imports by @dnalborczyk in https://github.com/node-fetch/node-fetch/pull/1428
* core: Warn when using data by @jimmywarting in https://github.com/node-fetch/node-fetch/pull/1421
* docs: Create SECURITY.md by @JamieSlome in https://github.com/node-fetch/node-fetch/pull/1445
* core: don't forward secure headers to 3th party by @jimmywarting in https://github.com/node-fetch/node-fetch/pull/1449

## New Contributors
* @mdmitry01 made their first contribution in https://github.com/node-fetch/node-fetch/pull/1392
* @tasinet made their first contribution in https://github.com/node-fetch/node-fetch/pull/1387
* @adamellsworth made their first contribution in https://github.com/node-fetch/node-fetch/pull/1405
* @maxshirshin made their first contribution in https://github.com/node-fetch/node-fetch/pull/1369
* @JamieSlome made their first contribution in https://github.com/node-fetch/node-fetch/pull/1445

**Full Changelog**: https://github.com/node-fetch/node-fetch/compare/v3.1.0...v3.1.2
  "version": "3.1.1",
CVE-2022-2596 (JavaScript, published 2022-08-01T15:15Z)
Description: value: Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.


Severity: nan (CVSS v3 base score: 5.9)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/node-fetch/node-fetch
Files changed:
src/utils/referrer.js
Commit message: fix: ReDoS referrer (#1611)

* fix ReDoS referrer

* Update src/utils/referrer.js

Eliminate regex and use string matcher

Co-authored-by: Linus Unnebäck <linus@folkdatorn.se>

Co-authored-by: Khang. Võ Vĩ <khangvv@vng.com.vn>
Co-authored-by: Linus Unnebäck <linus@folkdatorn.se>

Vulnerable code:
	if (/^(.+\.)*localhost$/.test(url.host)) {

Fixed code:
	if (url.host === 'localhost' || url.host.endsWith('.localhost')) {