hitoshura25/cvefixes huggingface dataset:
CVE-2018-16424 (C, published 2018-09-04T00:29Z)
Description: value: A double free when handling responses in read_file in tools/egk-tool.c (aka the eGK card tool) in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Severity: MEDIUM (CVSS v3 base score: 6.6)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/card-cac.c
src/libopensc/card-epass2003.c
src/libopensc/card-muscle.c
src/libopensc/card-tcos.c
src/libopensc/pkcs15-esteid.c
src/libopensc/pkcs15-gemsafeV1.c
src/libopensc/pkcs15-sc-hsm.c
src/libopensc/sc.c
src/tools/cryptoflex-tool.c
src/tools/egk-tool.c
src/tools/util.c
Commit message: fixed out of bounds writes

Thanks to Eric Sesterhenn from X41 D-SEC GmbH
for reporting the problems.


Vulnerable code:
		memcpy(serial->value, priv->cac_id, priv->cac_id_len);
	if (2 == cipher_len)
		u8* oid= fs->cache.array[x].objectId.id;
			count+=2;
		int j, len=apdu.resp[i+1];
			memcpy(file->name, d, len);
			file->namelen = len;
	buff[r] = '\0';
	while (ibuf[ind] == 0x01) {
		/* save EF_C_DevAut for further use */
		ptr = realloc(priv->EF_C_DevAut, len);
		if (ptr) {
			memcpy(ptr, efbin, len);
			priv->EF_C_DevAut = ptr;
			priv->EF_C_DevAut_len = len;
	if (sec_attr == NULL) {
	bufsize = file->size;
	bufsize = file->size;
	len = file ? file->size : 4096;
		strcat(line, buf);
		strcat(line, " ");

Fixed code:
		memcpy(serial->value, priv->cac_id, serial->len);
	if (2 == cipher_len || *out_len < cipher_len - 2)
			len = plain->resplen;
		u8* oid = fs->cache.array[x].objectId.id;
		if (bufLen < 2)
			break;
			count += 2;
			bufLen -= 2;
		size_t j, len=apdu.resp[i+1];
			file->namelen = MIN(sizeof file->name, len);
			memcpy(file->name, d, file->namelen);
	buff[MIN((size_t) r, (sizeof buff)-1)] = '\0';
	while (ibuf[ind] == 0x01 && i < gemsafe_cert_max) {
		if (len > 0) {
			/* save EF_C_DevAut for further use */
			ptr = realloc(priv->EF_C_DevAut, len);
			if (ptr) {
				memcpy(ptr, efbin, len);
				priv->EF_C_DevAut = ptr;
				priv->EF_C_DevAut_len = len;
			}
	if (sec_attr == NULL || sec_attr_len) {
#include "libopensc/internal.h"
	bufsize = MIN(file->size, sizeof buf);
	bufsize = MIN(file->size, sizeof buf);
	len = file && file->size > 0 ? file->size : 4096;
		strncat(line, buf, sizeof line);
		strncat(line, " ", sizeof line);
	line[(sizeof line)-1] = '\0'; /* make sure it's NUL terminated */
CVE-2018-16425 (C, published 2018-09-04T00:29Z)
Description: value: A double free when handling responses from an HSM Card in sc_pkcs15emu_sc_hsm_init in libopensc/pkcs15-sc-hsm.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.
Severity: MEDIUM (CVSS v3 base score: 6.6)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/card-cac.c
src/libopensc/card-epass2003.c
src/libopensc/card-muscle.c
src/libopensc/card-tcos.c
src/libopensc/pkcs15-esteid.c
src/libopensc/pkcs15-gemsafeV1.c
src/libopensc/pkcs15-sc-hsm.c
src/libopensc/sc.c
src/tools/cryptoflex-tool.c
src/tools/egk-tool.c
src/tools/util.c
Commit message: fixed out of bounds writes

Thanks to Eric Sesterhenn from X41 D-SEC GmbH
for reporting the problems.


Vulnerable code:
		memcpy(serial->value, priv->cac_id, priv->cac_id_len);
	if (2 == cipher_len)
		u8* oid= fs->cache.array[x].objectId.id;
			count+=2;
		int j, len=apdu.resp[i+1];
			memcpy(file->name, d, len);
			file->namelen = len;
	buff[r] = '\0';
	while (ibuf[ind] == 0x01) {
		/* save EF_C_DevAut for further use */
		ptr = realloc(priv->EF_C_DevAut, len);
		if (ptr) {
			memcpy(ptr, efbin, len);
			priv->EF_C_DevAut = ptr;
			priv->EF_C_DevAut_len = len;
	if (sec_attr == NULL) {
	bufsize = file->size;
	bufsize = file->size;
	len = file ? file->size : 4096;
		strcat(line, buf);
		strcat(line, " ");

Fixed code:
		memcpy(serial->value, priv->cac_id, serial->len);
	if (2 == cipher_len || *out_len < cipher_len - 2)
			len = plain->resplen;
		u8* oid = fs->cache.array[x].objectId.id;
		if (bufLen < 2)
			break;
			count += 2;
			bufLen -= 2;
		size_t j, len=apdu.resp[i+1];
			file->namelen = MIN(sizeof file->name, len);
			memcpy(file->name, d, file->namelen);
	buff[MIN((size_t) r, (sizeof buff)-1)] = '\0';
	while (ibuf[ind] == 0x01 && i < gemsafe_cert_max) {
		if (len > 0) {
			/* save EF_C_DevAut for further use */
			ptr = realloc(priv->EF_C_DevAut, len);
			if (ptr) {
				memcpy(ptr, efbin, len);
				priv->EF_C_DevAut = ptr;
				priv->EF_C_DevAut_len = len;
			}
	if (sec_attr == NULL || sec_attr_len) {
#include "libopensc/internal.h"
	bufsize = MIN(file->size, sizeof buf);
	bufsize = MIN(file->size, sizeof buf);
	len = file && file->size > 0 ? file->size : 4096;
		strncat(line, buf, sizeof line);
		strncat(line, " ", sizeof line);
	line[(sizeof line)-1] = '\0'; /* make sure it's NUL terminated */
CVE-2018-16426 (C, published 2018-09-04T00:29Z)
Description: value: Endless recursion when handling responses from an IAS-ECC card in iasecc_select_file in libopensc/card-iasecc.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to hang or crash the opensc library using programs.
Severity: LOW (CVSS v3 base score: 4.3)
Weakness: CWE-674 \u2014 Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place,  consuming excessive resources, such as allocated memory or the program stack.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/card-iasecc.c
Commit message: iasecc: fixed unbound recursion


Vulnerable code:
	if (lpath.len >= 2 && lpath.value[0] == 0x3F && lpath.value[1] == 0x00)   {
		if (lpath.len >= 2 && lpath.value[0] == 0x3F && lpath.value[1] == 0x00)	   {
			memmove(&lpath.value[0], &lpath.value[2], lpath.len - 2);
			lpath.len -=  2;
		}

Fixed code:
	if (path->type != SC_PATH_TYPE_DF_NAME
			&& lpath.len >= 2
			&& lpath.value[0] == 0x3F && lpath.value[1] == 0x00)   {
		memmove(&lpath.value[0], &lpath.value[2], lpath.len - 2);
		lpath.len -=  2;
CVE-2019-15945 (C, published 2019-09-05T17:15Z)
Description: value: OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Bitstring in decode_bit_string in libopensc/asn1.c.
Severity: MEDIUM (CVSS v3 base score: 6.4)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/asn1.c
Commit message: fixed out of bounds access of ASN.1 Bitstring

Credit to OSS-Fuzz


Vulnerable code:
	int zero_bits = *in & 0x07;
	size_t octets_left = inlen - 1;
	memset(outbuf, 0, outlen);
	in++;

Fixed code:
	int zero_bits;
	size_t octets_left;

	zero_bits = *in & 0x07;
	octets_left = inlen - 1;
	in++;
	memset(outbuf, 0, outlen);
CVE-2019-15946 (C, published 2019-09-05T17:15Z)
Description: value: OpenSC before 0.20.0-rc1 has an out-of-bounds access of an ASN.1 Octet string in asn1_decode_entry in libopensc/asn1.c.
Severity: MEDIUM (CVSS v3 base score: 6.4)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/asn1.c
Commit message: Fixed out of bounds access in ASN.1 Octet string

Credit to OSS-Fuzz


Vulnerable code:
			 && obj[0] == 0x00 && objlen > 1) {

Fixed code:
					&& objlen > 1 && obj[0] == 0x00) {
CVE-2019-19479 (C, published 2019-12-01T23:15Z)
Description: value: An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-setcos.c has an incorrect read operation during parsing of a SETCOS file attribute.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/card-setcos.c
Commit message: fixed  UNKNOWN READ

Reported by OSS-Fuzz
https://oss-fuzz.com/testcase-detail/5681169970757632


Vulnerable code:
			iPinCount = iACLen - 1;		

Fixed code:
			iPinCount = iACLen > 0 ? iACLen - 1 : 0;
CVE-2019-19480 (C, published 2019-12-01T23:15Z)
Description: value: An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/pkcs15-prkey.c has an incorrect free operation in sc_pkcs15_decode_prkdf_entry.
Severity: LOW (CVSS v3 base score: 4.6)
Weakness: CWE-672 \u2014 Operation on a Resource after Expiration or Release
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/pkcs15-prkey.c
Commit message: pkcs15-prkey: Simplify cleaning memory after failure

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18478


Vulnerable code:
		if (asn1_com_prkey_attr->flags & SC_ASN1_PRESENT &&
			asn1_com_prkey_attr[0].flags & SC_ASN1_PRESENT) {
			free(asn1_com_prkey_attr[0].parm);
		}

Fixed code:
		free(info.subject.value);
CVE-2019-19481 (C, published 2019-12-01T23:15Z)
Description: value: An issue was discovered in OpenSC through 0.19.0 and 0.20.x through 0.20.0-rc3. libopensc/card-cac1.c mishandles buffer limits for CAC certificates.
Severity: LOW (CVSS v3 base score: 4.6)
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/card-cac1.c
Commit message: cac1: Correctly handle the buffer limits

Found by oss-fuzz

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=18618
and others


Vulnerable code:
	size_t len, next_len;
	next_len = MIN(left, 100);
	for (; left > 0; left -= len, out_ptr += len) {
		len = next_len;
		next_len = MIN(left, apdu.sw2);
	size_t val_len;

Fixed code:
	size_t len;
	len = MIN(left, 100);
	for (; left > 0;) { /* Increments for readability in the end of the function */
		/* Adjust the lengths */
		left -= len;
		out_ptr += len;
		len = MIN(left, apdu.sw2);
	size_t val_len = 0;
CVE-2019-20792 (C, published 2020-04-29T04:15Z)
Description: value: OpenSC before 0.20.0 has a double free in coolkey_free_private_data because coolkey_add_object in libopensc/card-coolkey.c lacks a uniqueness check.
Severity: MEDIUM (CVSS v3 base score: 6.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/card-coolkey.c
Commit message: coolkey: Make sure the object ID is unique when filling list

Thanks to oss-fuzz

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=19208


Vulnerable code:

Fixed code:
	/* The object ID needs to be unique */
	if (coolkey_find_object_by_id(&priv->objects_list, object_id) != NULL) {
		return SC_ERROR_INTERNAL;
	}
CVE-2020-26570 (C, published 2020-10-06T02:15Z)
Description: value: The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/pkcs15-oberthur.c
Commit message: Heap-buffer-overflow WRITE

fixes https://oss-fuzz.com/testcase-detail/5088104168554496


Vulnerable code:
		int rec;
		int offs = 0;
		int rec_len = file->record_length;

Fixed code:
		size_t rec;
		size_t offs = 0;
		size_t rec_len = file->record_length;
			if (rec > file->record_count) {
				rv = 0;
				break;
			}
CVE-2020-26572 (C, published 2020-10-06T02:15Z)
Description: value: The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.
Severity: LOW (CVSS v3 base score: 5.5)
Weakness: CWE-787 \u2014 Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/card-tcos.c
Commit message: prevent out of bounds write

fixes https://oss-fuzz.com/testcase-detail/5226571123392512


Vulnerable code:

Fixed code:
	if (sizeof sbuf - 1 < crgram_len)
		return SC_ERROR_INVALID_ARGUMENTS;
CVE-2023-4535 (C, published 2023-11-06T17:15Z)
Description: value: An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to manipulate APDU responses and potentially gain unauthorized access to sensitive data, compromising the system's security.
Severity: nan (CVSS v3 base score: 3.8)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/libopensc/card-myeid.c
Commit message: myeid: fixed CID 380538  Out-of-bounds read (OVERRUN)

also fixes output buffer size checking


Vulnerable code:
				sdata = priv->sym_plain_buffer + block_size - pad_byte;
					if (sdata[i] != pad_byte)
			*outlen = return_len;
			if (out == NULL)

Fixed code:
				sdata = priv->sym_plain_buffer + block_size;
					if (*(--sdata) != pad_byte)
			if (out == NULL) {
				*outlen = return_len;
			}
			*outlen = return_len;
CVE-2024-1454 (C, published 2024-02-12T23:15Z)
Description: value: The use-after-free vulnerability was found in the AuthentIC driver in OpenSC packages, occuring in the card enrolment process using pkcs15-init when a user or administrator enrols or modifies cards. An attacker must have physical access to the computer system and requires a crafted USB device or smart card to present the system with specially crafted responses to the APDUs, which are considered high complexity and low severity. This manipulation can allow for compromised card management operations during enrolment.
Severity: nan (CVSS v3 base score: )
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/OpenSC/OpenSC
Files changed:
src/pkcs15init/pkcs15-authentic.c
Commit message: authentic: Avoid use after free

Thanks oss-fuzz

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=64898


Vulnerable code:
		if (!rv) {

Fixed code:
		if (rv < 0) {
CVE-2022-0664 (Go, published 2022-02-18T14:15Z)
Description: value: Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-321 \u2014 Use of Hard-coded Cryptographic Key
The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
Repository: https://github.com/gravitl/netmaker
Files changed:
logic/jwts.go
logic/util.go
Commit message: hotfix 2


Vulnerable code:
		jwtSecretKey = []byte(RandomString(64)) // 512 bit random password
// // GetNode - fetches a node from database
// func GetNode(macaddress string, network string) (models.Node, error) {
// 	var node models.Node

// 	key, err := GetRecordKey(macaddress, network)
// 	if err != nil {
// 		return node, err
// 	}
// 	data, err := database.FetchRecord(database.NODES_TABLE_NAME, key)
// 	if err != nil {
// 		if data == "" {
// 			data, _ = database.FetchRecord(database.DELETED_NODES_TABLE_NAME, key)
// 			err = json.Unmarshal([]byte(data), &node)
// 		}
// 		return node, err
// 	}
// 	if err = json.Unmarshal([]byte(data), &node); err != nil {
// 		return node, err
// 	}
// 	SetNodeDefaults(&node)
// 	return node, err
// }

Fixed code:
		newValue, err := GenerateCryptoString(64)
		if err != nil {
			logger.FatalLog("something went wrong when generating JWT signature")
		}
		jwtSecretKey = []byte(newValue) // 512 bit random password
	crand "crypto/rand"
	"math/big"
// GenerateCryptoString - generates random string of n length
func GenerateCryptoString(n int) (string, error) {
	const chars = "123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz-"
	ret := make([]byte, n)
	for i := range ret {
		num, err := crand.Int(crand.Reader, big.NewInt(int64(len(chars))))
		if err != nil {
			return "", err
		}
		ret[i] = chars[num.Int64()]
	}
	return string(ret), nil
}
CVE-2022-23650 (Unknown, published 2022-02-18T22:15Z)
Description: value: Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.
Severity: HIGH (CVSS v3 base score: 8.8)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/gravitl/netmaker
Files changed:
Commit message: Merge pull request #770 from gravitl/hotfix_v0.10.0_jwt_data

added jwt fix

Vulnerable code:

Fixed code:
CVE-2023-32077 (Go, published 2023-08-24T22:15Z)
Description: value: Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6.  If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/gravitl/netmaker
Files changed:
logic/security.go
servercfg/serverconf.go
Commit message: fixed hard coded dns key


Vulnerable code:
	return tokens[1] == servercfg.GetDNSKey()
	key := "secretkey"

Fixed code:
	return len(servercfg.GetDNSKey()) > 0 && tokens[1] == servercfg.GetDNSKey()
	key := ""
CVE-2023-32077 (Unknown, published 2023-08-24T22:15Z)
Description: value: Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. The issue is patched in 0.17.1 and fixed in 0.18.6.  If users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone who is using version 0.17.1 can pull the latest docker image of the backend and restart the server.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-798 \u2014 Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.
Repository: https://github.com/gravitl/netmaker
Files changed:
Commit message: Merge pull request #2170 from gravitl/GRA-1493/dns-key

GRA-1493: fixed hard coded dns key

Vulnerable code:

Fixed code:
CVE-2023-32078 (Unknown, published 2023-08-24T22:15Z)
Description: value: Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in the user update function. By specifying another user's username, it was possible to update the other user's password. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-639 \u2014 Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
Repository: https://github.com/gravitl/netmaker
Files changed:
Commit message: Merge pull request #2158 from gravitl/GRA-1479-user-updates

add checks to user update processing

Vulnerable code:

Fixed code:
CVE-2020-7760 (JavaScript, published 2020-10-30T11:15Z)
Description: value: This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/codemirror/CodeMirror
Files changed:
mode/javascript/javascript.js
Commit message: [javascript mode] Fix potentially-exponential regexp


Vulnerable code:
        if (word == "async" && stream.match(/^(\s|\/\*.*?\*\/)*[\[\(\w]/, false))

Fixed code:
        if (word == "async" && stream.match(/^(\s|\/\*([^*]|\*(?!\/))*?\*\/)*[\[\(\w]/, false))
CVE-2021-35206 (TypeScript, published 2021-06-22T14:15Z)
Description: value: Gitpod before 0.6.0 allows unvalidated redirects.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Repository: https://github.com/gitpod-io/gitpod
Files changed:
components/server/src/user/user-controller.ts
Commit message: [server/auth] ensure safe returnTo param


Vulnerable code:

Fixed code:
            this.ensureSafeReturnToParam(req);
            this.ensureSafeReturnToParam(req);
    protected ensureSafeReturnToParam(req: express.Request) {
        req.query.returnTo = this.getSafeReturnToParam(req);
    }