hitoshura25/cvefixes huggingface dataset:
CVE-2024-22194 (Python, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-337 \u2014 Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
case_utils/case_sparql_select/__init__.py
setup.cfg
Commit message: Merge branches 'HotFix-0.7.1-set_pyshacl_ceiling' and 'support-0.6.x' into release-0.7.1


Vulnerable code:
     for (row_no, row) in enumerate(graph.query(select_query_object)):
         for (column_no, column) in enumerate(row):
     rdflib >= 6.2.0

Fixed code:
     for row_no, row in enumerate(graph.query(select_query_object)):
         for column_no, column in enumerate(row):
+    rdflib >= 6.2.0, < 6.3.0
CVE-2024-22194 (Other, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-215 \u2014 Insertion of Sensitive Information Into Debugging Code
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
tests/case_utils/case_validate/uco_test_examples/Makefile
Commit message: Merge branches 'HotFix-0.6.1-refresh_pre_commit' and 'support-0.5.x' into release-0.6.1


Vulnerable code:
 case_srcdir := $(top_srcdir)/dependencies/CASE
 
 uco_srcdir := $(case_srcdir)/dependencies/UCO

Fixed code:
+uco_srcdir := $(top_srcdir)/dependencies/CASE/dependencies/UCO
CVE-2024-22194 (Other, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-337 \u2014 Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
tests/case_utils/case_validate/uco_test_examples/Makefile
Commit message: Merge branches 'HotFix-0.6.1-refresh_pre_commit' and 'support-0.5.x' into release-0.6.1


Vulnerable code:
 case_srcdir := $(top_srcdir)/dependencies/CASE
 
 uco_srcdir := $(case_srcdir)/dependencies/UCO

Fixed code:
+uco_srcdir := $(top_srcdir)/dependencies/CASE/dependencies/UCO
CVE-2024-22194 (Unknown, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-215 \u2014 Insertion of Sensitive Information Into Debugging Code
The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
Commit message: Merge branch 'release-0.11.1' into support-0.11.x


Vulnerable code:

Fixed code:
CVE-2024-22194 (Unknown, published 2024-01-11T03:15Z)
Description: value: cdo-local-uuid project provides a specialized UUID-generating function that can, on user request, cause a program to generate deterministic UUIDs. An information leakage vulnerability is present in `cdo-local-uuid` at version `0.4.0`, and in `case-utils` in unpatched versions (matching the pattern `0.x.0`) at and since `0.5.0`, before `0.15.0`. The vulnerability stems from a Python function, `cdo_local_uuid.local_uuid()`, and its original implementation `case_utils.local_uuid()`. 
Severity: nan (CVSS v3 base score: 2.8)
Weakness: CWE-337 \u2014 Predictable Seed in Pseudo-Random Number Generator (PRNG)
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Repository: https://github.com/casework/CASE-Utilities-Python
Files changed:
Commit message: Merge branch 'release-0.11.1' into support-0.11.x


Vulnerable code:

Fixed code:
CVE-2015-10068 (Java, published 2023-01-18T08:15Z)
Description: value: A vulnerability classified as critical was found in danynab movify-j. This vulnerability affects the function getByMovieId of the file app/business/impl/ReviewServiceImpl.java. The manipulation of the argument movieId/username leads to sql injection. The name of the patch is c3085e01936a4d7eff1eda3093f25d56cc4d2ec5. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218476.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/danynab/movify-j
Files changed:
app/business/impl/ReviewServiceImpl.java
app/controllers/WebplayerController.java
Commit message: Avoid SQL Injection


Vulnerable code:
        return find.where("movieId = " + movieId + " and username = '" + username + "'").findUnique();
@With(LoginRequiredAction.class)
//@With({LoginRequiredAction.class, SubscriptionRequiredAction.class})

Fixed code:
import com.avaje.ebean.Expr;
        return find.where().and(Expr.eq("movieId", movieId), Expr.eq("username", username)).findUnique();
import filters.SubscriptionRequiredAction;
@With({LoginRequiredAction.class, SubscriptionRequiredAction.class})
CVE-2023-46725 (Unknown, published 2023-11-02T15:15Z)
Description: value: FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery. In the Network module, a manufacturer account can use the `/api/updateProducts.json` endpoint to make the server send a request to an arbitrary host. This means that the server can be used as a proxy into the internal network where the server is. Furthermore, the checks on a valid image are not adequate, leading to a time of check time of use issue. For example, by using a custom server that returns 200 on HEAD requests, then return a valid image on first GET request and then a 302 redirect to final target on second GET request, the server will copy whatever file is at the redirect destination, making this a full SSRF. Version 3.6.1 fixes this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-367 \u2014 Time-of-check Time-of-use (TOCTOU) Race Condition
The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
Repository: https://github.com/foodcoopshop/foodcoopshop
Files changed:
Commit message: Merge pull request #972 from foodcoopshop/remotefile

Remotefile security fix

Vulnerable code:

Fixed code:
CVE-2023-46725 (Unknown, published 2023-11-02T15:15Z)
Description: value: FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery. In the Network module, a manufacturer account can use the `/api/updateProducts.json` endpoint to make the server send a request to an arbitrary host. This means that the server can be used as a proxy into the internal network where the server is. Furthermore, the checks on a valid image are not adequate, leading to a time of check time of use issue. For example, by using a custom server that returns 200 on HEAD requests, then return a valid image on first GET request and then a 302 redirect to final target on second GET request, the server will copy whatever file is at the redirect destination, making this a full SSRF. Version 3.6.1 fixes this vulnerability.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-918 \u2014 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Repository: https://github.com/foodcoopshop/foodcoopshop
Files changed:
Commit message: Merge pull request #972 from foodcoopshop/remotefile

Remotefile security fix

Vulnerable code:

Fixed code:
CVE-2014-2209 (C++, published 2014-12-28T15:59Z)
Description: value: Facebook HipHop Virtual Machine (HHVM) before 3.1.0 does not drop supplemental group memberships within hphp/util/capability.cpp and hphp/util/light-process.cpp, which allows remote attackers to bypass intended access restrictions by leveraging group permissions for a file or directory.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-264 \u2014 Permissions, Privileges, and Access Controls
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/util/capability.cpp
hphp/util/light-process.cpp
Commit message: Drop supplementary groups when changing to non-root

Summary: When running HHVM as a non-root user, UID and GID are updated correctly but supplementary groups are not dropped properly. This runs initgroups inside main thread and lightprocess threads to reset groups to those of the specified non-root user.

Reviewed By: @markw65

Differential Revision: D1193229


Vulnerable code:

Fixed code:
#include <grp.h>
    if (initgroups(pw->pw_name, pw->pw_gid) < 0) {
      Logger::Error("unable to drop supplementary group privs: %s",
                    folly::errnoStr(errno).c_str());
      return false;
    }

#include <grp.h>
        initgroups(pw->pw_name, pw->pw_gid);
CVE-2014-5386 (C++, published 2014-12-28T15:59Z)
Description: value: The mcrypt_create_iv function in hphp/runtime/ext/mcrypt/ext_mcrypt.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 does not seed the random number generator, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging the use of a single initialization vector.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-310 \u2014 Cryptographic Issues
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/ext/mcrypt/ext_mcrypt.cpp
Commit message: Fix mcrypt_create_iv(..., MCRYPT_RAND) to auto-seed RNG

Summary: Without seeding the random number generator,
we'll always get the same IV, and that reduces the security
of this function.

Fortunately, f_rand() has all of that logic for auto-seeding
and selection of a suitable initial seed built-in.

Realistically, using MCRYPT_RAND should be deprecated.
I'm going to wait on PHP Internals to make a decision on
https://wiki.php.net/rfc/deprecate_mcrypt_rand
before adding that warning however, so that our test suite
remains consistent.

Credit: Theodore R. Smith of PHP Experts, Inc. <theodorephpexperts.pro>

Closes #3496

Reviewed By: @ptarjan

Differential Revision: D1502435


Vulnerable code:
      iv[--size] = (char)(255.0 * rand() / RAND_MAX);

Fixed code:
#include "hphp/runtime/ext/ext_math.h"
      // Use userspace rand() function because it handles auto-seeding
      iv[--size] = (char)f_rand(0, 255);
CVE-2014-6228 (PHP, published 2014-12-28T15:59Z)
Description: value: Integer overflow in the string_chunk_split function in hphp/runtime/base/zend-string.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted arguments to the chunk_split function.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/base/zend-string.cpp
hphp/test/slow/ext_string/chunk_split_overflow.php
hphp/test/slow/ext_string/chunk_split_overflow.php.expectf
Commit message: Fix integer overflow in chunk_split

Reviewed By: @ptarjan

Differential Revision: D1515947


Vulnerable code:
  int out_len = (chunks + 1) * endlen + srclen;
  String ret(out_len, ReserveString);

Fixed code:
  String ret(
    safe_address(
      chunks + 1,
      endlen,
      srclen
    ),
    ReserveString
  );
<?php

chunk_split(str_repeat('*', 2000000), 1.0, str_repeat('*', 2000000));

Fatal error: String length exceeded 2^31-2: 4000004000000 in %s on line 3
CVE-2014-6229 (C++, published 2014-12-28T15:59Z)
Description: value: The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string, and makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging truncation of a string containing an internal '\0' character.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/ext/ext_hash.cpp
Commit message: Fix potential security leak in HashContext

Summary: CVE-2014-6229

This is not a NUL-terminated string, it's a fixed-size block of data.
The risks were key truncation (if there happens to be a NUL byte in the
key) or over-reading (which would be information leakage).

Reviewed By: @ptarjan

Differential Revision: D1533546


Vulnerable code:
    key = ctx->key ? strdup(ctx->key) : nullptr;

Fixed code:
    if (ctx->key) {
      key = static_cast<char*>(malloc(ops->block_size));
      memcpy(key, ctx->key, ops->block_size);
    } else {
      key = nullptr;
    }
CVE-2014-9714 (PHP, published 2015-04-13T14:59Z)
Description: value: Cross-site scripting (XSS) vulnerability in the WddxPacket::recursiveAddVar function in HHVM (aka the HipHop Virtual Machine) before 3.5.0 allows remote attackers to inject arbitrary web script or HTML via a crafted string to the wddx_serialize_value function.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/ext/wddx/ext_wddx.cpp
hphp/test/slow/ext_wddx/htmlent.php
hphp/test/slow/ext_wddx/htmlent.php.expect
Commit message: HTMLEncode strings in wddx_serialize_value()

Summary: Strings returned through wddx_serialize_value should be HTMLEncode()'d during
serialization.

Fixes #4283

{sync, type="child", parent="internal", parentrevid="1691695", parentrevfbid="1537976659780590", parentdiffid="5726084"}

Reviewed By: @JoelMarcey

Differential Revision: D1691695

Signature: t1:1691695:1416530595:722bfcdaf7c0dbee379bea886cd4c43d997ca7dd


Vulnerable code:
    std::string varValue = varVariant.toString().data();

Fixed code:
    std::string varValue;
    } else {
      varValue = StringUtil::HtmlEncode(varVariant.toString(),
                                        StringUtil::QuoteStyle::Double,
                                        "UTF-8", false, false).toCppString();
<?php
$s = wddx_serialize_value("Test for &");
var_dump($s);
$d = wddx_deserialize($s);
var_dump($d);
string(92) "<wddxPacket version='1.0'><header/><data><string>Test for &amp;</string></data></wddxPacket>"
string(10) "Test for &"
CVE-2016-1000004 (PHP, published 2020-02-19T13:15Z)
Description: value: Insufficient type checks were employed prior to casting input data in SimpleXMLElement_exportNode and simplexml_import_dom. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-345 \u2014 Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/ext/simplexml/ext_simplexml.cpp
hphp/test/slow/ext_domdocument/simplexml_null.php
hphp/test/slow/ext_domdocument/simplexml_null.php.expectf
Commit message: Type safety in simplexml import routines

Reviewed By: Orvid

Differential Revision: D3447275

fbshipit-source-id: d859c97f9d85c520b0e371cef6dcb19bb2ef7dbf


Vulnerable code:
  assert(sxe->instanceof(SimpleXMLElement_classof()));
  const Object& node,
  const String& class_name /* = "SimpleXMLElement" */) {

Fixed code:
  if (!sxe->instanceof(SimpleXMLElement_classof())) return nullptr;
const StaticString s_DOMNode("DOMNode");

                             const Object& node,
                             const String& class_name) {
  if (!node->instanceof(s_DOMNode)) {
    raise_warning("Invalid Nodetype to import");
    return init_null();
  }
<?php

$date = date_create_immutable();
var_dump(dom_import_simplexml($date));
var_dump(simplexml_import_dom($date));
Warning: Invalid Nodetype to import in %s/test/slow/ext_domdocument/simplexml_null.php on line 4
NULL

Warning: Invalid Nodetype to import in %s/test/slow/ext_domdocument/simplexml_null.php on line 5
NULL
CVE-2016-1000005 (PHP, published 2020-02-19T13:15Z)
Description: value: mcrypt_get_block_size did not enforce that the provided "module" parameter was a string, leading to type confusion if other types of data were passed in. This issue affects HHVM versions prior to 3.9.5, all versions between 3.10.0 and 3.12.3 (inclusive), and all versions between 3.13.0 and 3.14.1 (inclusive).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-843 \u2014 Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/ext/mcrypt/ext_mcrypt.cpp
hphp/runtime/ext/mcrypt/ext_mcrypt.php
hphp/test/slow/ext_mcrypt/ext_mcrypt.php
hphp/test/slow/ext_mcrypt/ext_mcrypt.php.expectf
Commit message: Fix param types for mcrypt_get_block_size() to match PHP

Reviewed By: edwinsmith

Differential Revision: D3447281

fbshipit-source-id: a88549307faad886f5a0f78d421aa28e08d21b1c


Vulnerable code:
                                    const Variant& module /* = null_string */) {
                                 (char*)module.asCStrRef().data(),
                               ?string $mode = null): mixed;

Fixed code:
                                             const String& mode) {
                                 (char*)mode.data(),
                               string $mode): mixed;
mcrypt_get_block_size("tripledes");

Warning: mcrypt_get_block_size() expects exactly 2 parameters, 1 given in %s/test/slow/ext_mcrypt/ext_mcrypt.php on line 109
CVE-2016-1000109 (C++, published 2020-02-19T13:15Z)
Description: value: HHVM does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. This issue affects HHVM versions prior to 3.9.6, all versions between 3.10.0 and 3.12.4 (inclusive), and all versions between 3.13.0 and 3.14.2 (inclusive).
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-665 \u2014 Improper Initialization
The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
Repository: https://github.com/facebook/hhvm
Files changed:
hphp/runtime/server/fastcgi/fastcgi-transport.cpp
Commit message: CVE-2016-1000109: Ignore Proxy HTTP header from fastcgi requests

Summary:
The default PHP behavior is to transform a Proxy header from requests
into the HTTP_PROXY environment variable in the PHP environment running the
request. Some scripts may use this env var to decide which HTTP proxy to
connect to, and we don't want requests to have that kind of control over
scripts' behavior.

Reviewed By: alexmalyshev, Orvid

Differential Revision: D3579221

fbshipit-source-id: 18a405fd73aee65283aea99ff995f8082b3fc3b5


Vulnerable code:

Fixed code:
  // Don't allow requests to inject an HTTP_PROXY environment variable by
  // sending a Proxy header.
  if (strcasecmp(key.c_str(), "HTTP_PROXY") == 0) return;